Multiple Vulnerabilities in Industrial Control Systems

Affected Environment
ICS-connected products from FURUNO, Ebyte, Bendix, PayRange, Siemens, ZoneMinder and Rently, spanning marine, industrial, automotive and smart home systems.

Threat Overview
Multiple vulnerabilities enable unauthorized access, remote code execution, authentication bypass, session hijacking, configuration changes and denial of service.

Exposure Timeline
Published via CISA ICS advisories on 26 August 2026, with fixes available for most vendors except Ebyte and PayRange.

Attack Surface
Web management interfaces, MQTT traffic, in-vessel networks, brake ECU firmware, and Node-RED HTTP endpoints exposed on affected devices.

Technical Root Cause
Hard-coded credentials, missing authentication, cleartext transmission, client-side authentication logic, buffer overflows and unsanitized command injection across products.

Exploitation Pathway
Attackers exploit exposed interfaces, weak credentials or unsanitized inputs to gain administrative access or execute arbitrary code remotely.