Keyword

ics-ot

2 dispatches · latest 08 SEP 2026 · all keywords →

08 SEP 2026exploits

The VPN That Signed You In as Root: IXON's Unauthenticated Config Endpoint and CVE-2026-75925

IXON's OT-focused VPN client writes config from a local endpoint that checks no credentials, then feeds it to a root subprocess with CRLF un-neutralized. CVSS 9.6 — and the injected config survives reboots while your VPN keeps working perfectly.

Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.CVSS 9.6CVE-2026-75925

vpn ixon cve-2026-75925

05 SEP 2026exploits

A Blank Field Is Not a Permission List: Ignition's Default Gives Project Creation to Any Logged-In User

Ignition <= 8.1.53 ships its 'Create Project Role(s)' gateway setting empty — and in Ignition, empty means 'anyone.' CVE-2026-77393 (CVSS 8.8) is the five-minute config check your SCADA box has been waiting for.

High severity, 3 of 4. Patch at your next window. Real impact, real exposure.CVSS 8.8CVE-2026-77393

ignition scada hmi