Plaintext Credential Storage in HMS Products
CVE-2026-39460

9.3CRITICAL

Key Information:

Vendor

Red Lion Controls

Status
700 Series
Vendor
CVE Published:
9 October 2026

What is CVE-2026-39460?

This vulnerability allows for the exposure of sensitive information, as usernames and passwords, including default factory credentials, are stored in plaintext within a configuration file. Attackers with administrator access can easily view this file through the command line interface (CLI) or by exporting it via TFTP from the web interface. Notably, the TFTP transfer can be initiated through SNMP, which does not require authentication, thereby increasing the risk of unauthorized access. Ensuring proper credential management and securing configuration files are essential to mitigate this vulnerability.

Affected Version(s)

700 Series 0

700 Series 0

700 Series 3.11.1

References

https://www.hms-networks.com/
https://www.hms-networks.com/cybersecurity
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabrianna (Ria) Milloway of Idaho National Laboratory reported this vulnerability to CISA.
.