Weak Encryption in Configuration Files for HMS Networks Products
CVE-2026-28745

9.3CRITICAL

Key Information:

Vendor

Red Lion Controls

Status
700 Series
Vendor
CVE Published:
9 October 2026

What is CVE-2026-28745?

A significant vulnerability exists in HMS Networks products where user credentials, including default passwords, are stored in configuration files using weak encryption methods. If an adversary gains access to these files, they could easily exploit the weakly encrypted credentials to gain unauthorized access to critical systems. This flaw emphasizes the need for stronger encryption protocols and better security practices to protect sensitive information from potential breach.

Affected Version(s)

700 Series 0

700 Series 0

700 Series 3.11.1

References

https://www.hms-networks.com/
https://www.hms-networks.com/cybersecurity
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabrianna (Ria) Milloway of Idaho National Laboratory reported this vulnerability to CISA.
.