CVE-2026-28745CWE-257

CVE-2026-28745

High · published October 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00217 · 11.5th percentile
Weakness
CWE-257 · Storing Passwords in a Recoverable Format
Published
2026-10-09T19:17Z
References (4)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01 · [email protected]https://www.hms-networks.com/ · [email protected]https://www.hms-networks.com/cybersecurity · [email protected]
EPSS history
Timeline
  • 11 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 09 OCT 14:36Z
    Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format
    cvelistv5
  • 09 OCT 14:36Z
    Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format
    cvelistv5