CVE-2026-29797
Received Received - Intake

Authentication Bypass in N-Tron Firmware via SNMP/TFTP

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: ICS-CERT

Description
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-29797
EUVD
EUVD-2026-95813

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Red Lion Controls 700 Series 0
Red Lion Controls 700 Series 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthorized firmware or bootloader updates on N-Tron devices without authentication. Attackers can exploit it by pushing malicious files or scanning networks for vulnerable devices using SNMP or TFTP protocols.

Detection Guidance

Detect this vulnerability by scanning for N-Tron devices on your network using SNMP or TFTP protocols. Look for unauthorized firmware update attempts or bootloader changes without authentication. Monitor network traffic for suspicious file transfers to these devices.

Impact Analysis

Unauthorized firmware changes could lead to device compromise, data breaches, or operational disruptions. Attackers might gain control over the device, steal sensitive information, or cause system failures.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure firmware updates and access controls, such as GDPR's data protection principles or HIPAA's security rules for medical devices.

Mitigation Strategies

Immediately restrict SNMP and TFTP access to N-Tron devices via network segmentation or firewall rules. Disable unauthenticated firmware updates and bootloader changes. Implement strong authentication for all device management interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-29797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart