Industrial network switches can be taken over without a password.

A line of network equipment installed in control cabinets around the world will hand full administrative control to anyone who can reach it across the network. No password is needed. CISA, the American cyber security agency, set the finding out earlier this month and revised the document a week later.

The devices are managed industrial switches: hardened boxes, usually smaller than a shoebox, that carry traffic between controllers, meters, cameras and the control room. They are bought once, bolted into a cabinet and expected to run for a decade without anybody opening the enclosure. The advisory lists seven separate weaknesses in them, and the worst need no credentials of any kind.

If your organisation runs a plant, a substation, a pump station, a packing line or a building management system, somebody in it has almost certainly bought switches of this class. A corrected release exists. So the thing worth passing to the engineering manager is not the patch. It is a harder question: can anyone in the business say where these devices are, and who can reach them?

What it means where the plant is

Several of the seven share one property, which is that they need nothing but a route to the device. SNMP, the long-standing protocol network equipment uses to report its health and accept configuration, answers administrative requests on these switches without asking who is calling. That covers handing over the configuration file, rewriting user accounts, and loading new firmware or a new bootloader.

The configuration file matters more than its name suggests. Usernames and passwords sit inside it in readable form, including the factory ones, and a second finding records the same credentials held under encryption too weak to protect them. The factory administrator account stays live even after a site has created its own accounts. Credentials get reused across cabinets and across sites, so one readable configuration file is rarely one switch's problem.

Firmware is the part a maintenance manager should sit up for. Nothing on the device checks that an incoming firmware image came from the vendor, and the push itself needs no login, so a device on the same network can be found and reflashed by anything speaking the right protocols. Firmware is not something a site inspects by eye. It is a line in an audit record.

Then the blunt one. A single request to the right address on the switch's web interface restarts it, and repeating that request keeps it restarting. On a mine or a mill, a switch held in a reboot loop is the moment telemetry from a substation stops arriving and commands stop landing. That is a supervisor working the phone instead of the mimic, the control room's live diagram of the plant, and an engineer called out to a cabinet nobody had scheduled work on. The equipment is listed as deployed worldwide, across critical manufacturing, communications, commercial facilities and ordinary IT estates.

The questions this leaves with the people who own the plant

The vendor's position is clear enough: install the corrected release, and in the meantime tighten or switch off the monitoring protocol's access and close the switch's web interface. Guidance of that shape is easy to publish and awkward to act on, because every word of it assumes somebody knows where the devices are.

So the first question for whoever holds the asset register is not about firmware. It is whether the register lists managed switches by model and installed version, or whether it stops at "network equipment, cabinet four". A patch cannot be scheduled for a device no record admits to.

The second belongs to the integrator who built the panel. Which switches were commissioned with the factory administrator account left in place, and can the monitoring protocol reach them from anywhere other than the network management station? Both answers are in somebody's commissioning notes rather than in the advisory.

The third is a scheduling question, and it is the one that will decide how long this takes. Upgrading a switch drops the link it carries, so the work needs a window, and on a continuous process the window, not the download, is the constraint. The question for whoever signs that window off is which links can be taken down separately and which would stop the plant.

The remaining finding needs physical access: somebody at the cabinet can start the switch from factory settings, log in with the default administrator account, and make a configuration change that survives the next normal boot. That one is a question about keys, locks and who walks the plant rooms, and it is answered by the facilities team rather than by any firmware.

CISA has had no report of public exploitation aimed specifically at these weaknesses, which buys a site time rather than removing the problem. The advisory itself will be superseded within a year by the next one. An accurate answer to which switches are installed, at what version, and reachable from where, is the thing a site actually keeps.

The technical record

CISA ICS advisory ICSA-26-281-01, published 8 October 2026 and revised 15 October 2026 as Update A, which corrected CVSS v4.0 scores and broken links. Advisory headline score: CVSS v3 8.3.

Affected products: Red Lion Controls N-Tron 700 Series, Firmware_3.11.0 and earlier, and Bootloader_2.0.6.1 and earlier. All seven CVEs apply to both. Remediation: upgrade to version 3.11.1 or greater; configure or turn off the SNMP communities; close access to the web GUI. The upgrade procedure document and the vendor's own advisory are published by HMS Networks.

Scores below are CVSS v3.1 then CVSS v4.0.

• CVE-2026-32645, use of hard-coded credentials (CWE-798): 6.0 medium, 8.3 high. Factory administrative credentials persist after other administrator accounts are configured.
• CVE-2026-39460, insufficiently protected credentials (CWE-522): 8.1 high, 8.6 high. Plaintext credentials in the configuration file, exportable by TFTP transfer that SNMP can initiate unauthenticated.
• CVE-2026-28745, storing passwords in a recoverable format (CWE-257): 7.5 high, 9.3 critical. Weak encryption of stored credentials.
• CVE-2026-33367, missing authentication for a critical function (CWE-306): 8.1 high, 8.6 high. Unauthenticated administrative action over SNMP, including configuration retrieval, account changes and firmware or bootloader upgrade and downgrade.
• CVE-2026-29797, download of code without an integrity check (CWE-494): 7.1 high, 7.1 high. Unauthenticated firmware and bootloader update, with network discovery and transfer over SNMP and TFTP.
• CVE-2026-39453, reachable assertion (CWE-617): 8.3 high, 7.2 high. A specific web server URL reboots the switch, and the request can be automated into continuous reboots.
• CVE-2026-33272, authentication bypass using an alternate path or channel (CWE-288): 4.9 medium, 5.2 medium. Requires physical access; persists configuration changes made from factory settings.

Sectors listed: commercial facilities, communications, critical manufacturing, information technology. Deployment: worldwide. Vendor headquarters: Sweden. Reported to CISA by a researcher at Idaho National Laboratory. The advisory closes with the agency's usual network exposure and remote access guidance, and records no reported public exploitation of these vulnerabilities.