7 dispatches · latest 16 SEP 2026 · all keywords →
CISA advisory ICSA-26-258-08 covers seven CVEs in the CareCam CM2507 IP camera (firmware v251211.1507). Headlined by unauthenticated live video over the network — and no fix exists, because CareCam hasn't answered CISA's coordination attempts.
CISA advisory ICSA-26-258-01 covers six CVEs across the entire Digital Watchdog VMAX DVR/NVR line — all versions affected. An unauthenticated request can hand over your admin credentials in plaintext, and a hard-coded credential scores 9.6.
CVE-2026-16347 (CVSS 8.8) hits every version of RouterOS: the API auth path has no real rate-limiting, lockout, or source restriction, so admin credentials can be hammered at high volume. CISA published ICSA-26-209-05 with a mitigation checklist that is the whole post.
A ~$63 Chinese wireless USB print server whose entire job is to sit on your LAN and share a dumb printer just got a CISA ICS advisory: three CVEs, two of them CVSS 9.8 with no authentication required. All fixed in firmware 2.1.240. If you own one, patch it and VLAN it.
ICSA-26-239-05 rates the under-$40 Ebyte NA111-M RS485-to-Ethernet gateway with 13 CVEs on firmware 9013-2-17 — six of them CVSS 9.8, including an unauthenticated admin interface and cleartext MQTT. If you bolt one onto a PLC, a printer, or an e-bike, read this.
NSA, CISA, FBI, DOE, and EPA warn of an active threat to every Siemens S7-series PLC, with AI-generated exploit scripts built on open-source snap7 libraries. Here's what it means if you don't read ICS advisories for a living.
In April, EPA, FBI, CISA, and NSA issued a rare joint advisory on Iranian-affiliated attacks against the water sector. Here's what it means if you don't read ICS advisories for a living.