Nine advisories in one day, from brake computers to ship transponders

CISA published seven new ICS advisories on 25 August 2026. Two older advisories were revised the same day, so nine advisory pages carry that date. The seven new ones are numbered ICSA-26-237-01 through ICSA-26-237-07, and the two revised ones are marked Update A. For five of the nine, the highest listed CVSS v3.1 score is 9.1 or above.

What happens technically

The products on the list have little in common beyond sitting on a network. Siemens SIMATIC IoT2050 Advanced scores 10.0 in ICSA-26-237-03, the highest the scale allows. Bendix EC80 is a brake control unit, and ICSA-26-237-05 describes the loss of ABS functions, steering assist, speedometer or shifting capabilities, or automatic traction control being disabled. FURUNO FA-50 is an AIS transponder carried on board vessels, and the higher of the two vulnerabilities in ICSA-26-237-07 is scored 9.1. The four remaining new advisories cover Rently Smart Home, the Zoneminder software, the PayRange API and the Ebyte NE2-D11 gateway. CISA files the nine advisories under seven different critical infrastructure sectors, and six of them are listed as deployed worldwide.

Five of the nine advisories describe the same underlying flaw. The Siemens device enforces no authentication on the Node-RED HTTP interface, and CISA writes that an unauthenticated remote attacker can create malicious flows and execute arbitrary code with maximum privileges. The Ebyte NE2-D11 does not consistently enforce authentication before granting access to administrative functionality, and eleven CVE numbers are listed against firmware FW-9167-0-11. The FURUNO advisory states that some configurations may be changed on the management screen without authentication. Both revised advisories also concern authentication bypass. In the Lantronix case, authentication on the management pages can be bypassed by appending a specific suffix to the URL and sending an Authorization header that uses admin as the username.

Two of the advisories instead describe text supplied by the user landing directly in a shell. In Zoneminder the exportFile parameter is passed unsanitized into a shell command executed through the PHP function exec, so any authenticated user holding the View Events permission can run operating system commands on the server as the web server user. In the Lantronix advisory, CVE-2025-67038 describes the username from a failed login being concatenated straight into the command that writes the log, with the command executing at root privilege. The Zoneminder advisory is not entirely consistent, since version 1.38.3 appears both as an affected version and as the version users should upgrade to.

Vendor responses differ sharply. Rently patched the flaw in late June, and CISA writes that no user action is required. Siemens, Zoneminder, Bendix, Optigo Networks and Lantronix have all shipped new versions. According to its advisory, PayRange has not responded to requests to work with CISA on a fix. Ebyte acknowledged receipt and said a patch was under development, but has not answered later requests, and CISA has not been informed of the status. FURUNO states that production of the FA-50 ended in October 2020 and that no further software updates will be provided. Eight of the nine advisories state that no known public exploitation has been reported to CISA. The Siemens advisory lacks that sentence. The same advisory is a republication of Siemens ProductCERT advisory SSA-834709, published on 11 August. For Zoneminder, CISA also notes that it discovered a public proof of concept itself and reported it to the vendor.

What this means for you if you run embedded systems

If you have equipment like this in place, the hard part is rarely installing the fix. The hard part is knowing the equipment is there at all. An AIS transponder, a brake control unit and an industrial gateway get mounted once and then forgotten, and none of them speak up when they need attention. Our assessment is that the 25 August list works better as a test of your asset inventory than as a patch list. If you cannot say whether any of the nine products sit in your estate, you have already found the most important gap.

Three of the nine advisories leave you nothing to install. FURUNO says plainly that the FA-50 will receive no further updates, PayRange has not answered CISA, and Ebyte went quiet after its first acknowledgement. At that point the work shifts from rollout to risk treatment, and someone has to make that decision and write it down. FURUNO's own advice is not to connect the product directly to the internet and to keep the vessel locked and properly managed. That advice compensates for a flaw that stays in place. If you own equipment in that category, it is worth knowing that the residual risk is yours, and that the vendor is not going to take it off your hands.

Berigo recommends

• Check the nine products against your asset inventory today, and write down the ones you cannot answer for.
• Update Siemens SIMATIC IoT2050 Advanced to V4.3.4.1 or later, or uninstall Node-RED if the device does not use it.
• Record a documented decision on FURUNO FA-50, PayRange and Ebyte NE2-D11, since no fix has been promised for them.
• Make sure management interfaces are not reachable from the internet, and separate control equipment from the office network.
• Write vendor response times for vulnerabilities into your contracts, so that silence carries a consequence.