Topic
CISA industrial control system advisories disclosing vulnerabilities in operational and networking equipment.
CISA lists four CVEs in every version of Monta's EV-charging platform that let attackers pose as charging stations. Monta is phasing out unauthenticated access on a rolling basis and has not said when it will finish.
Reality
CISA says Viidure's dashcam platform keeps user records, live footage and firmware in a cloud bucket that anyone on the internet can read. Viidure did not answer CISA and plans no fix, so the advisory can only point users to the vendor's support page.
Reality
CISA lists 37 VIVOTEK camera models open to CVE-2026-22755, a command injection bug that can give attackers remote command execution, potentially as root. Exploit code was public before the advisory, so the first job for owners is finding out which of their cameras are on the list.
Reality
CVE-2026-89207 lets an unauthenticated remote attacker trip protection mode on Siemens WTV676-HB6035 and WTV776-HB6035 web interfaces. The fixed builds, V3.94 and V4.17, are available now.
Reality
CVE-2026-15688 lets someone running the software locally get past a block password and edit the loaded module in memory. Mitsubishi Electric's remedy is a new build plus a security setting applied project by project.
Reality
Every version of five Digital Watchdog VMAX recorder lines ships with a web path that returns administrator passwords in the clear. CISA says the same devices can be used to pivot onto the network behind them.
Reality
CVE-2026-80465 lets an unauthenticated remote attacker hijack an account in some single sign-on setups. The fix is a Mendix Marketplace module update. It has to be taken app by app across three version trains.
Reality
CISA's September 10 advisory says an authenticated user can push Orthanc's image decode past the end of a heap allocation. The stated outcome is a crash, and the only remedy listed is an upgrade to 1.13.0.
Reality
The advisory on TPDIN-Monitor-WEB3 2.2.9 and earlier lists hard-coded credentials, cross-site request forgery and missing authorization on units running in energy and critical manufacturing. Firmware v2.4.2 is the whole fix.
Reality
Rockwell found and reported both CVEs itself, and the only fix is firmware v2.002 on hardware wired into running machines. That puts this on a maintenance calendar rather than an incident bridge, with the web server outage the part that bites during a fault chase.
Reality
CISA's March 31 advisory assigns CVE-2026-3356 to all versions of four Anritsu Remote Spectrum Monitor models whose management interface has no authentication to switch on. The vendor has no plans to fix it.
Reality
CISA's August 27 advisory lists three flaws in the LK100W below firmware 2.1.240, and one of them hands an attacker the authenticated position another one requires. The firmware is the only device-specific fix.
Reality