Today’s OT security briefing covers five verified advisories affecting industrial switches, energy-sector software, communications design tools, device servers, and legacy RTU firmware.
CISA warns of seven vulnerabilities in Red Lion N-Tron 700 Series switches
CISA released ICSA-26-281-01 on October 8, covering Red Lion Controls N-Tron 700 Series managed industrial Ethernet switches with firmware <=3.11.0 or bootloader <=2.0.6.1. The advisory lists seven CVEs involving hard-coded credentials, insufficient password protection, missing authentication for critical functions, code download without integrity checks, reachable assertion, and authentication bypass through an alternate path or channel.
For OT and critical infrastructure, the issue matters because CISA identifies Commercial Facilities, Communications, Critical Manufacturing, and Information Technology sectors, and says successful exploitation could grant administrative access to view, edit, and upload configuration files. CISA also describes a URL-triggered reboot behavior that could be scripted to cause continuous switch reboots; these are potential outcomes, not a confirmed exploitation event or outage.
Practical takeaways are to verify N-Tron 700 firmware and bootloader versions, upgrade to firmware 3.11.1 or later where applicable, configure or disable SNMP communities, and disable access to the web GUI after operational impact review.
Sources: CISA ICSA-26-281-01; CISA October 8 ICS bulletin; CISA CSAF advisory data.
CISA issues advisory on Grid Protection Alliance openPDC and openHistorian vulnerabilities
CISA released ICSA-26-281-02 on October 8 for Grid Protection Alliance openPDC, the openPDC Docker image, and openHistorian versions below the fixed releases listed in the advisory. CISA associates five CVEs with openPDC and openHistorian, plus CVE-2026-105278 with the Docker image, and lists vulnerability classes including unauthenticated critical-function access and unsafe deserialization.
This matters to OT because CISA identifies the Energy sector and worldwide deployment. NIST’s NVD record for CVE-2026-105281 says the openPDC internal data publisher accepts network connections without authentication in its default configuration, allowing a network attacker to retrieve system device and measurement topology; CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to it at publication time.
Practical takeaways are to identify exposed openPDC and openHistorian deployments, reduce network exposure, keep control-system networks behind firewalls and isolated from business networks, and use appropriately secured, current VPNs when remote access is necessary.
Sources: CISA ICSA-26-281-02; NVD CVE-2026-105281.
CISA advisory: Satel Netco Design vulnerabilities could enable file manipulation and arbitrary code execution
CISA released ICSA-26-281-03 on October 8 for Satel Netco Design versions before 2.1.7, reporting a vendor-equipment CVSS v3 score of 8.8 and listing cross-site scripting, inefficient regular-expression complexity, and relative path traversal. A regional government advisory identifies CVE-2026-105269, CVE-2026-104628, and CVE-2026-101024, while NVD also records CVE-2026-105275 for path traversal in the data-import function.
For OT and critical infrastructure, the relevance is that CISA places the product in the Communications sector and says it is deployed worldwide. NVD describes CVE-2026-101024 as permitting an authenticated Viewer to write attacker-influenced content to application-accessible locations, potentially enabling unauthorized file creation or modification and, under certain conditions, arbitrary code execution; NVD describes CVE-2026-105275 as allowing an authenticated Viewer to access paths outside the intended directory and use application responses to determine whether host files exist. CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to it at publication time.
Practical takeaways are to update to version 2.1.7 or later after impact analysis and risk assessment, reduce exposure of the application, segment and firewall control-system networks, and use current, secure VPNs for necessary remote access.
Sources: CISA ICSA-26-281-03; Euskadi government advisory; NVD CVE-2026-101024; NVD CVE-2026-105275.
CISA updates Lantronix EDS3000PS/EDS5000 advisory with revised CVE information
CISA updated ICSA-26-069-02 on October 8 as Update B, described in the revision history as updated CVE information. Affected products include EDS5000 series <=2.1.0.0R3 and EDS3000PS series <=3.1.0.0R2, along with listed versions of Lantronix G520, X300, E210, and E220 series products.
This matters for OT because Lantronix serial device servers and related products are used in industrial environments, and CISA identifies Communications, Information Technology, and Critical Manufacturing sectors with worldwide deployment. CISA describes possible outcomes including authentication bypass and root-level code execution, but reports no known public exploitation specifically targeting these vulnerabilities at the time of the advisory and does not identify a confirmed organization-specific incident or operational outage.
Practical takeaways are to check deployed Lantronix product families and firmware versions, prioritize the fixed releases listed by CISA, including EDS5000 firmware 2.2.0.0R1 or later and EDS3000PS firmware 3.2.0.0R2 or later, and account for operational dependencies before updating serial connectivity infrastructure.
Sources: CISA ICSA-26-069-02; CISA October 8 ICS bulletin.
Hitachi Energy warns of serious flaws in end-of-life RTU500 firmware
Hitachi Energy advisory 8DBD000251, dated September 29 and republished by CISA on October 6, addresses findings reported by Dragos affecting RTU500 series CMU firmware up to and including 11.x. These firmware versions are end-of-life, and Hitachi says currently supported CMU firmware versions are not affected.
For OT, the issue is significant because RTU500 remote terminal units collect and communicate physical-grid data to SCADA systems, and CISA identifies the Energy sector and worldwide deployment. CVE-2026-8065 describes unauthenticated arbitrary firmware upload via a crafted POST request, CVE-2026-8066 describes unauthenticated directory traversal through file upload enabling arbitrary file writes or overwrites, and CVE-2026-8067 concerns an authenticated user triggering a device reboot. The cited sources describe risks and mitigations but do not establish exploitation in the wild.
Practical takeaways are to identify any RTU500 CMU firmware up to and including 11.x, plan upgrades to currently supported firmware, and apply CISA’s exposure-reduction guidance by minimizing network exposure, placing control systems behind firewalls, and isolating them from business networks.
Sources: ISSSource report; CISA ICSA-26-279-06; Hitachi Energy PSIRT advisory index.
