CVE-2026-33367
Received Received - Intake

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: ICS-CERT

Description
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-33367
EUVD
EUVD-2026-95812

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Red Lion Controls 700 Series 0
Red Lion Controls 700 Series 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves SNMP (Simple Network Management Protocol) allowing unauthenticated administrative actions on devices. Attackers can retrieve configuration files, modify user accounts or device settings, and upgrade or downgrade firmware or bootloaders without authentication.

Detection Guidance

Detecting SNMP vulnerabilities like CVE-2026-33367 requires checking for open SNMP ports and misconfigurations. Use commands like 'nmap -sU -p 161 <target>' to scan for open UDP port 161. Check SNMP community strings with 'snmpwalk -v 2c -c public <target>' or 'snmpget -v 2c -c public <target> sysDescr.0'. Ensure SNMP is disabled if unused.

Impact Analysis

Unauthenticated access to administrative functions can lead to unauthorized control of devices, data breaches, system manipulation, or disruption of services. Attackers may gain full control over affected systems, leading to potential data loss or operational failures.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system integrity. GDPR and HIPAA mandate strict access controls and data security. Unauthorized access risks non-compliance, potential fines, and reputational damage due to compromised sensitive data or systems.

Mitigation Strategies

Immediately disable SNMP if not required. If SNMP is necessary, restrict access using firewalls to trusted IPs only. Change default community strings to strong, unique values. Update SNMP configurations to use SNMPv3 with authentication and encryption. Monitor network traffic for unauthorized SNMP queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart