Daily OT Security News: November 04, 2026
Five source-verified developments and their operational implications.
1. CISA flags authorization and SQL-injection flaws in Subnet Solutions PowerSYSTEM Center
Source date: 2026-11-03
News briefing
CISA's advisory ICSA-26-307-01 identifies incorrect authorization and SQL-injection vulnerabilities in Subnet Solutions' PowerSYSTEM Center, which is deployed worldwide in the energy and critical manufacturing sectors. Successful exploitation could permit unauthorized SQL commands and access to unauthorized resources. CISA lists PowerSYSTEM Center 2020 versions ≤5.29.x with one vulnerability; 2024 versions ≥6.0.x and ≤6.2.x with two; and 2026 versions ≥7.0.x and ≤7.1.x with two. CISA says the vulnerabilities are not remotely exploitable and that no known public exploitation specifically targeting them had been reported to it at publication. Verification limit: the accessible advisory does not confirm the CVE identifiers, per-flaw version mapping or a fixed version; the two CVE records cited by secondary coverage remained reserved when checked.
OT implications
Identify potentially affected installations and restrict application and account access. Check control-system network segmentation and avoid exposing control-system devices to the internet; use current, secure VPNs where remote access is required, consistent with CISA's general guidance. Confirm applicable fixes and interim controls directly with Subnet Solutions before deployment. The advisory does not establish process manipulation, operational disruption or a safety impact, and the absence of reported public exploitation is not proof that no private compromise occurred.
Sources
- CISA original advisory: ICSA-26-307-01, Subnet Solutions PowerSYSTEM Center
- CISA official release bulletin for ICSA-26-307-01
- CVE.org record: CVE-2026-63017 (reserved)
- CVE.org record: CVE-2026-63774 (reserved)
2. Zyxel warns of buffer overflow in access points, FWA7 devices and security routers
Source date: 2026-11-03
News briefing
Zyxel disclosed CVE-2026-76955, a buffer overflow in the zdp_wtp binary of firmware used by listed access points, FWA7 devices and security routers. The vendor says a LAN-based attacker could escalate privileges on an affected device. For example, NWA110AX firmware 7.12(ABTG.0)C0 and earlier is affected; Zyxel lists 7.12(ABTG.1)C0 as the fixed release. The vendor provides model-specific fixes and says a WAC500H hotfix is available from local support. Italy’s national cybersecurity agency separately issued an alert referencing the Zyxel advisory. The cited sources describe a vulnerability, not a confirmed compromise.
OT implications
Inventory affected Zyxel equipment that provides connectivity for cameras, building systems or industrial sites, and compare exact model and firmware versions with the vendor’s table. Coordinate and test firmware updates with network and operational owners, allowing for possible connectivity interruption. Restrict access from untrusted LAN segments and protect management networks as general defense-in-depth measures; do not assume segmentation alone fixes the flaw. A compromised network device could threaten connectivity or create a foothold, depending on its access and network design; no downstream OT incident is established by these sources.
Sources
- Zyxel security advisory for buffer overflow vulnerability in certain APs, FWA7, and Security Routers
- Zyxel community advisory with publication timestamp
- Italian National Cybersecurity Agency: vulnerabilities addressed in Zyxel products
3. MediaTek flags cellular-modem flaw in chipsets used in industrial mobile devices
Source date: 2026-11-02
News briefing
MediaTek’s November 2026 Product Security Bulletin rates CVE-2026-20499 critical. The modem flaw involves a possible out-of-bounds write caused by a missing bounds check. MediaTek’s CVE record says remote privilege escalation could occur if a device connects to an attacker-controlled rogue base station; no additional execution privileges or user interaction are needed. The affected-chipset list includes MT6765 and MT8788. MediaTek said it had notified device manufacturers of the issues and patches at least two months before publication and was not aware of active exploitation at that time. Google’s November 2 Android bulletin lists the CVE under the 2026-11-05 security patch level; that date is a patch-level label, not proof that a particular device has received an update.
OT implications
Inventory cellular-capable operational endpoints, including rugged handhelds and tablets, and ask their manufacturers to confirm chipset, affected firmware and available fixes. For context, Arrvel’s October 23 announcement describes its F1 and F2 industrial barcode terminals as using MT6765 and 4G LTE; the chipset match is a reason to check, not confirmation that any particular unit is unpatched or exploitable. Test and schedule the device maker’s update around operational requirements. If an update is unavailable, consider whether temporarily disabling cellular connectivity is operationally feasible, with the device owner’s approval; network segmentation or password changes alone do not fix the modem flaw.
Sources
- November 2026 Product Security Bulletin — MediaTek
- CVE Record: CVE-2026-20499 — MediaTek CNA record
- Android Security Bulletin—November 2026 — Google
- Arrvel Introduces Industrial Barcode Scanner and Handheld Terminal Lineup for Global Enterprises
4. ODVA reports CIP Security specification certification to IEC 62443-4-2 SL-C 3
Source date: 2026-11-02
News briefing
Industrial Cyber reported on November 2 that ODVA's CIP Security specification had achieved TÜV Rheinland certification against applicable requirements of IEC 62443-4-2:2019, up to Security Level Capability 3. ODVA's original announcement was dated October 22; its indexed material says the certificate was issued June 15. CIP Security is an application-layer security extension for EtherNet/IP that ODVA describes as supporting authentication, authorization, integrity and confidentiality using TLS and DTLS. The certification concerns the specification, not every product implementing it. Verification limit: the reviewed material did not include a direct TÜV certificate document or certificate ID. This is a standards announcement, not an identified vulnerability or incident.
OT implications
Engineering and procurement teams can treat the specification's certification as an assurance input while requesting product-specific evidence: which versions implement CIP Security, which protections and configurations are supported, and whether the actual product has applicable IEC 62443-4-2 certification. Correctly implemented communications protections may reduce risk, but they do not establish the security of an entire installation or, on their own, compliance with the EU Cyber Resilience Act. No patch or incident response is established by this announcement.
Sources
- Industrial Cyber — ODVA's CIP Security achieves TÜV Rheinland certification
- ODVA — CIP Security earns IEC 62443-4-2 certification
- ODVA publication index — CIP Security: A Certified Foundation for IEC 62443-4-2
- IoT Insider — CIP Security achieves IEC 62443-4-2 certification
5. CISA launches Critical Infrastructure Security and Resilience Month
Source date: 2026-11-02
News briefing
CISA launched its November 2026 Critical Infrastructure Security and Resilience Month campaign, urging organizations to identify important systems and external dependencies, understand risks, prepare clear response and recovery plans, and track progress and update plans with lessons learned. The agency says the campaign aligns with the President's National Resilience Strategy. Acting Director Nick Andersen emphasized understanding systems and having a usable disruption plan. This is a general preparedness announcement, not a vulnerability or incident advisory: it does not name OT or ICS products, CVEs, patches or remediation deadlines. Verification limit: although the announcement points to a toolkit, the toolkit page reviewed was labeled for 2024, so its 2026 contents could not be established.
OT implications
OT-dependent organizations can apply the general guidance by documenting control-system assets and dependencies, including communications, utilities, suppliers and supporting IT; prioritizing disruption scenarios; and exercising continuity and restoration plans. Degraded-operation and recovery exercises should reflect operational and safety constraints. These are practical OT applications of CISA's campaign, not specific technical requirements in its announcement.
