Welcome to Daily OT Security News for October 12, 2026. Here are five verified advisories and vendor notices that matter for operational technology teams.
Each briefing includes source-listed mitigations and direct links to primary references.
CISA warns of EasyIO FG controller flaws that could enable full device access
News briefing
CISA republished Johnson Controls advisory JCI-PSA-2026-12, noting vulnerabilities in EasyIO FG firmware ≤ 2.0b52 under CVE-2026-27872 and CVE-2026-27873. The Canadian Centre for Cyber Security lists affected versions prior to 2.0b52; that boundary should be confirmed with the vendor. CISA cites hard-coded credentials and improper privilege management, vendor CVSS v3 7.7, potential full unauthorized device access, high attack complexity, not remotely exploitable, and no known public exploitation at publication. Affected sectors include critical manufacturing, commercial facilities, government, transportation, and energy, with worldwide deployment.
What to do
- Minimize control-system exposure; do not allow internet access.
- Place control networks and remote devices behind firewalls; isolate from business networks.
- If remote access is needed, use a secure, up-to-date VPN and consider the security of connected devices.
- Perform impact analysis and risk assessment before changes. Apply necessary updates as they become available and confirm the exact affected-version boundary with Johnson Controls.
Sources: CISA — Johnson Controls EasyIO FG (ICSA-26-279-01); Canadian Centre for Cyber Security — AV26-991
Critical buffer overflow in Savannah lwIP SMTP client 2.2.1
News briefing
CISA reports CVE-2026-15340 affecting Savannah lwIP SMTP client 2.2.1 with CVSS v3 9.8. Successful exploitation could crash the accessed device and may allow remote code execution. NVD classifies the flaw as CWE-120 (missing input-size checks) and notes patch_125_smtp_txbuf.diff and commit 614420f82c8729d070e01464c0dddb3c9525c772 as unaffected (record enrichment pending). CISA highlights impact to sectors including energy and water/wastewater.
What to do
- Do not expose control systems to the internet; segment with firewalls and isolate from business networks.
- Use maintained VPNs for required remote access, noting overall security depends on connected devices.
- Confirm remediation with the project or device vendor; verify applicability of the referenced patch/commit. Conduct impact analysis and risk assessment prior to deployment.
Sources: CISA — ICSA-26-279-02; NVD — CVE-2026-15340
Seven vulnerabilities in Red Lion Controls N-Tron 700 Series switches
News briefing
CISA details seven CVEs in N-Tron 700 Series firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier, including issues with credentials, missing authentication, missing code-integrity checks, a reachable assertion, and authentication bypass. Exploitation could provide administrative access to view, edit, or upload configuration files; a separate URL-triggered reboot issue could be scripted to repeatedly restart a switch. CISA noted no known public exploitation at publication. HMS Networks provides product resources for the 700 series.
What to do
- Upgrade N-Tron 700 Series firmware to version 3.11.1 or later, following vendor procedures and assessing operational impact.
- Configure or disable SNMP communities and disable access to the web GUI as recommended.
- Minimize exposure: keep devices off the internet, segment behind firewalls, and isolate control networks. Use a current, secured VPN if remote access is required.
Sources: CISA — Red Lion Controls N-Tron 700 Series (ICSA-26-281-01); HMS Networks Support — 700 Industrial Ethernet Switches
Vulnerabilities in Grid Protection Alliance openPDC and openHistorian
News briefing
CISA lists multiple CVEs for openPDC and openHistorian, with affected thresholds below openPDC 2.9.477 and 2.9.482, openHistorian 2.8.580 and 2.8.585, and Docker openPDC below 2.9.477 and 2.9.482. Issues include untrusted-data deserialization, missing authentication, SSRF, hard-coded credentials, and unsafe reflection. CVSS v3 is 9.8, and CISA reported no known public exploitation at publication. Separately, Grid Protection Alliance disclosed on July 3, 2026 an adapter-loading command-execution issue requiring an authenticated account and filesystem write access, with adapter-verification checks added in openPDC 2.9.477+ and openHistorian 2.8.580+. GPA did not map that issue to CISA’s CVEs.
What to do
- Reduce network exposure; keep systems off the internet and segment control networks behind firewalls.
- Use a maintained VPN for necessary remote access and consider the security of connected devices.
- Apply vendor fixes appropriate to your deployment and confirm exact release applicability with GPA.
- For the adapter-loading issue described by GPA: restrict filesystem write access to product directories, use least-privilege service accounts, and monitor logs for unusual activity.
Sources: CISA — openPDC and openHistorian (ICSA-26-281-02); Grid Protection Alliance — Adapter Code Injection Disclosure
Four vulnerabilities in Satel Netco Design; update to v2.1.7
News briefing
CISA reports four CVEs in Satel Netco Design earlier than v2.1.7: stored XSS (CVE-2026-105269), inefficient regex complexity (CVE-2026-104628), import path traversal (CVE-2026-105275), and export path traversal (CVE-2026-101024). Consequences include script execution in another user’s browser, resource exhaustion, determining host-file existence, unauthorized file creation/modification, and potentially arbitrary code execution. Flaws require authentication (Network Operator for XSS; Viewer for others). No known public exploitation at publication. CISA’s CSAF rates the export path traversal CVSS v3.1 8.8 (High).
What to do
- Update Satel Netco Design to v2.1.7.
- Minimize exposure: keep control systems off the internet, segment with firewalls, and isolate from business networks.
- If remote access is required, use a maintained VPN and assess risks and operational impact before changes.
Sources: CISA — ICSA-26-281-03; CISA CSAF — icsa-26-281-03.json
