CVE-2026-39460: CWE-522 in Red Lion Controls 700 Series

This vulnerability (CVE-2026-39460) in Red Lion Controls 700 Series devices involves plaintext storage of sensitive credentials in the configuration file. The configuration file can be accessed by administrators through the CLI or exported via TFTP from the web interface. Notably, SNMP can initiate a TFTP transfer without authentication, potentially allowing unauthorized access to the configuration file and exposing usernames and passwords, including default credentials. The CVSS 3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

Exposure of plaintext usernames and passwords, including default factory credentials, can lead to credential compromise and unauthorized access to the device. The ability to initiate TFTP transfers via unauthenticated SNMP increases the risk of unauthorized disclosure of sensitive configuration data. This can result in full compromise of device confidentiality and integrity, though availability impact is not indicated.

No official patch or fix is currently documented for this vulnerability. Users should consult Red Lion Controls for any updates or advisories. Until a fix is available, restrict SNMP access to trusted networks and administrators only, disable unnecessary SNMP services if possible, and monitor for unauthorized TFTP transfers. Avoid using default credentials and change them immediately upon deployment.