CVE-2026-33367CWE-306

CVE-2026-33367

High · published October 9, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-09T19:17Z
References (4)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01 · [email protected]https://www.hms-networks.com/ · [email protected]https://www.hms-networks.com/cybersecurity · [email protected]
EPSS history
Timeline
  • 11 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 09 OCT 14:38Z
    Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
    cvelistv5
  • 09 OCT 14:38Z
    Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
    cvelistv5