---
id: CVE-2026-33367
title: >-
  SNMP can be used to perform administrative actions such as retrieving
  configuration files, modifying user accounts or device settings, and
  initiating firmware or bootloader upgrades or downgrades—all without any
  authentication.
summary: >-
  SNMP can be used to perform administrative actions such as retrieving
  configuration files, modifying user accounts or device settings, and
  initiating firmware or bootloader upgrades or downgrades—all without any
  authentication.
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-306
published: '2026-10-09'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T17:17:04.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33367'
references:
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01'
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.hms-networks.com/'
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.hms-networks.com/cybersecurity'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
  - cve.org
epss: 0.0029
epssPercentile: 0.21394
ingestedAt: '2026-10-09T16:02:33.388Z'
vendor: Red Lion Controls
product: 700 Series
affected:
  - 700_series < Firmware Versions 3.11.0
  - 700_series < Bootloader Versions 2.0.6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-11T16:49:45.274509Z'
---

## Overview

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.