Daily OT Security News: November 05, 2026
Five source-verified developments and their operational implications.
1. Johnson Controls fixes flaws in EasyIO Neo commissioning software
Source date: November 3, 2026
News briefing
Johnson Controls disclosed three vulnerabilities in EasyIO Neo IO Manager, a commissioning tool for configuring and managing building-automation controllers. The advisory lists IOManager 1.1.0.0 and Tools-Installer-1.1.0.0 as affected. CVE-2026-106020 concerns an uncontrolled library search path that could allow malicious code execution; CVE-2026-106022 could let a local user extract sensitive authentication or authorization information from process memory; and CVE-2026-64894 concerns replacement of unsigned binaries or libraries. The vendor identifies IO Manager 2.0 and Tools-Installer-2.0.0.0 as the fix and recommends backup, operational-impact assessment and testing before deployment. Its advisory does not establish active exploitation.
OT implications
Inventory commissioning workstations and the building controllers they administer. Apply the vendor update in a managed maintenance window, with least privilege and restricted directory permissions as interim precautions. The vendor lists affected version 1.1.0.0 but its uninstall instructions refer to 1.0.0.0, so confirm the procedure with Johnson Controls. A compromised engineering workstation could put controller configuration at risk; the advisory does not report actual building-service disruption.
Sources
2. Researchers identify a separate exploited flaw in Zyxel GS1900 switches
Source date: November 3, 2026
News briefing
Binarly identified CVE-2026-107441, a separate out-of-bounds write in the web-management software of Zyxel GS1900 switches. Zyxel says a LAN-based unauthenticated attacker can use a crafted HTTP request to execute operating-system commands on affected devices. Binarly says network reachability to the management service is sufficient and found that firmware issued for the earlier CVE-2026-7273 did not fix this separate flaw. Binarly linked its recovered exploit to a campaign in which GreyNoise reported compromise of 996 switches; those reports do not independently establish the firmware or exploit used for every victim. Zyxel lists model-specific affected releases through 2.90(code.2)C0 and patched 2.90(code.3)C0 builds for the models in its advisory.
OT implications
Check GS1900 model and firmware against Zyxel’s exact model-specific table and restrict access to switch management interfaces. Coordinate updates with network and physical-security teams: PoE switch models can power devices including IP cameras. The reports do not establish that any particular OT or physical-security system was compromised or disrupted.
Sources
- Zyxel: GS1900 CVE-2026-107441 advisory
- Binarly: recovered exploit and technical analysis
- GreyNoise: campaign investigation
3. Google disrupts XCPE firmware botnet affecting more than 1.3 million devices
Source date: November 2, 2026
News briefing
Google says a firmware-preinstalled backdoor enrolled more than 1.3 million Android set-top boxes in the XCPE botnet; it also observed infected Android-based telehealth, digital-signage and karaoke devices. Google attributes the operation with high confidence to device manufacturer Videostrong and reports activity including proxying, advertising fraud, further malware deployment, screenshots, command execution and data exfiltration. It says it disrupted command infrastructure, banned the company and related firms from producing certified Android devices or supplying certified vendors, and changed firmware-review practices. The implant was present before sale and did not require a malicious user download.
OT implications
Review device suppliers and network-connected IoT inventory, isolate suspect devices in coordination with service owners, and use the researchers’ published indicators where appropriate. Disruption of infrastructure is not the same as removal of the implant from devices; TrendAI says cleanup requires vendor or platform action or replacement. Google does not establish an OT system compromise, patient-data exposure or physical-service interruption.
Sources
- Google Threat Intelligence: XCPE botnet
- TrendAI Research: botnet disruption and persistence
- Synthient: XCPE investigation and indicators
4. ASUS issues AiCloud router update for adjacent-network vulnerability
Source date: November 4, 2026
News briefing
ASUS disclosed CVE-2026-84730 in certain ASUSWRT 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102 firmware series. The vendor’s CVE record describes a stack-based buffer overflow triggered by a crafted device name that could allow an unauthenticated nearby attacker to execute commands as root; ASUS also describes possible denial of service. The company recommends updating to the latest firmware. If an update cannot be applied immediately, it recommends disabling AiCloud until updated, using strong unique credentials, keeping untrusted devices off local and wireless networks, restricting web management to trusted local networks and disabling WAN management. The reviewed sources do not establish attacks in the wild.
OT implications
If an affected router connects an operational or physical-security environment, check its firmware and dependent services and schedule the vendor update with the network owner. Adjacent-network access is a meaningful prerequisite and should not be described as unrestricted internet exploitation. ASUS lists firmware series rather than a complete affected-model or model-specific fixed-build table; confirm those details with the vendor.
Sources
5. Arista revises Linux kernel vulnerability assessment for NDR appliances
Source date: November 2, 2026; revised November 3
News briefing
Arista identifies Network Detection and Response Security Platform versions through 5.4.11 as affected by CVE-2026-98432, a Linux IPv4 TCP use-after-free. Arista says the only known exploitation method at publication required Multipath TCP, or MPTCP, to be enabled. Anthropic demonstrated unauthenticated remote root execution against a Linux server with an MPTCP listener; that proof of concept is not evidence of an attack on an Arista customer. Arista says it is unaware of malicious exploitation in customer networks. The vendor planned to disable MPTCP automatically on online NDR appliances and directed air-gapped customers to support; it listed no fixed release or hotfix in the reviewed advisory.
OT implications
Determine whether affected monitoring appliances are present and whether they are online or air-gapped. Confirm mitigation status with Arista and coordinate any patch with the security and operations teams. Disabling MPTCP reduces exposure but does not fix the underlying kernel flaw. The cited sources do not establish monitoring loss or disruption to an OT or physical-security environment.
