Usernames and passwords, including default factory credentials, are stored in plaintext within the configuration file. An attacker with administrative rights can read the file via the command‑line interface or export it via TFTP from the web interface, and the TFTP transfer can be triggered through SNMP without requiring authentication. Consequently, the device’s authentication mechanisms are rendered ineffective and an attacker can obtain the necessary credentials to gain full control of the system. The weakness falls under CWE‑522.

Systems affected are Red Lion Controls N‑Tron 700 Series devices running firmware versions earlier than 3.11.1. The vendor recommends upgrading to firmware 3.11.1 or later and disabling or configuring SNMP communities and web GUI access.

The CVSS base score of 9.3 indicates a high severity vulnerability. Although the EPSS score is not available, the lack of authentication on the SNMP trigger and the ease of retrieving credentials suggest that exploitation is likely if the device is exposed to an attacker. The advisory has not been listed in the CISA KEV catalog, but the potential for widespread impact warrants immediate attention. Attack vectors include remote SNMP commands and web‑based TFTP downloads, both of which can be performed without prior authentication.