Alertas de ciberseguridad OT
Escribe tu PLC, HMI, variador o switch y mira al momento si tiene vulnerabilidades conocidas.
Busca en los avisos ICS de CISA y en la Base Europea de Vulnerabilidades (EUVD) de ENISA.
Últimas alertas OT
Último aviso: 15 de octubre de 2026 · Comprobado: 16 oct, 12:10 · Se actualiza cada hora
- Crítica · 9.8NuevoAviso CISAMitigaciones disponibles
Guangzhou Juan IoT Technology EseeCloud
ICSA-26-288-02 · Energy, Communications, Transportation Systems, Financial Services, Government Services and Facilities
Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras.
- Alta · 8.2NuevoAviso CISACorrección disponible
Eclipse Foundation Eclipse Milo
ICSA-26-288-01 · Chemical, Critical Manufacturing, Energy, Water and Wastewater Systems
Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.
- Media · 6.2Aviso CISAMitigaciones disponibles
Swann Communications SWIFI-SE2KIC
ICSA-26-286-02 · Commercial Facilities
Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication.
- Alta · 8.8MaquinariaAviso CISAMitigaciones disponibles
Inductive Automation Ignition Software
ICSA-26-286-01 · Critical Manufacturing, Energy, Information Technology
Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level.
- Alta · 8.8Aviso CISACorrección disponible
Satel Netco Design
ICSA-26-281-03 · Communications
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code.
- Crítica · 9.8Aviso CISACorrección disponible
Grid Protection Alliance openPDC and openHistorian
ICSA-26-281-02 · Energy
- Alta · 8.3MaquinariaAviso CISACorrección disponible
Red Lion Controls N-Tron 700 Series - Update A
ICSA-26-281-01 · Revisión 2 · Commercial Facilities, Communications, Critical Manufacturing, Information Technology
Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to reboot by navigating to a specific URL on the device. Th…
- Alta · 8.1Aviso CISACorrección disponible
CISA Malcolm
ICSA-26-280-01 · Revisión 2 · Energy, Information Technology, Water and Wastewater Systems
- Crítica · 9.8Aviso CISAMitigaciones disponibles
Savannah lwIP SMTP client
ICSA-26-279-02 · Energy, Water and Wastewater Systems
Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution.
- Alta · 7.7Aviso CISAMitigaciones disponibles
Johnson Controls EasyIO FG
ICSA-26-279-01 · Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device.
- Alta · 7.7Aviso CISASin corrección publicada
Meari IoT Cloud Platform OpenAPI Service
ICSA-26-274-06 · Commercial Facilities, Information Technology
Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization.
- Media · 5.4Aviso CISAMitigaciones disponibles
Johnson Controls EasyIO Neo Series EC and CW Controllers
ICSA-26-274-05 · Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data.
- Baja · 3.5Aviso CISAMitigaciones disponibles
Johnson Controls EasyIO Neo Series EC and CW Controllers
ICSA-26-274-04 · Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system.
- Media · 6.4MaquinariaAviso CISAMitigaciones disponibles
ABB Protection and Control IED Manager PCM600
ICSA-26-274-03 · Energy
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files.
- Crítica · 9.4Aviso CISAMitigaciones disponibles
Monta monta.app
ICSA-26-274-02 · Energy, Transportation Systems
Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
- Crítica · 9.8Aviso CISACorrección disponible
Armatura LLC Armatura One
ICSA-26-274-01 · Communications, Critical Manufacturing, Energy, Transportation Systems
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system.
- Crítica · 10.0Aviso CISASin corrección publicada
Viidure Dashcam Android Application
ICSA-26-272-07 · Transportation Systems
Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform.
- Crítica · 9.8Aviso CISACorrección disponible
MikroTik RouterOS
ICSA-26-272-06 · Revisión 2 · Communications, Information Technology
Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service.
- Crítica · 9.8Aviso CISASin corrección publicada
Anjvision YSSD-RTMP-H5
ICSA-26-272-05 · Commercial Facilities
Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device.
- Alta · 7.4Aviso CISASin corrección publicada
Baicells Nova 430H
ICSA-26-272-04 · Communications, Information Technology
Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition.
- Crítica · 10.0Aviso CISAMitigaciones disponibles
VIVOTEK Camera Firmware
ICSA-26-272-03 · Government Services and Facilities, Transportation Systems, Commercial Facilities, Energy, Critical Manufacturing, Financial Services
Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system.
- Crítica · 10.0Aviso CISAMitigaciones disponibles
Toptech TMS7 and TopHAT
ICSA-26-272-02 · Energy, Chemical, Transportation Systems
Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code.
- Alta · 7.5Aviso CISAMitigaciones disponibles
Lantronix G520 Series Cellular Gateway
ICSA-26-272-01 · Transportation Systems, Energy, Water and Wastewater Systems
Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privileges.
- Crítica · 9.8MaquinariaAviso CISACorrección disponible
Hitachi Energy RTU500
ICSA-26-279-06 · Revisión 2 · Energy
Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions that were developed according to the cybersecurity requirements, threat lan…
- Media · 6.5MaquinariaAviso CISACorrección disponible
Hitachi Energy REB500
ICSA-26-279-05 · Revisión 2 · Energy
Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remedi…
¿Has visto un dato incorrecto?
Si eres fabricante o usuario y detectas un error, un aviso ya resuelto o una vulnerabilidad atribuida a un producto que no corresponde, escríbenos a hola@enbra.es indicando el identificador del aviso. Lo revisaremos y, si procede, lo corregiremos o retiraremos. También puedes usar el enlace «Informar de un error» de cada aviso.
Fuentes y condiciones de uso
Fuentes. Avisos ICS publicados por la Cybersecurity and Infrastructure Security Agency (CISA) de EE. UU. en formato CSAF (TLP:CLEAR) y Base Europea de Vulnerabilidades (EUVD) de la Agencia de la Unión Europea para la Ciberseguridad (ENISA). Los datos de vulnerabilidades proceden del programa CVE®; CVE es una marca registrada de The MITRE Corporation. La probabilidad de explotación es la puntuación EPSS de FIRST.org, tal como la publica EUVD (véase EPSS en first.org/epss). Los enlaces de CVE llevan a la National Vulnerability Database (NVD) del NIST. ENBRA no está afiliada a CISA, ENISA, MITRE, FIRST ni al NIST, y nada en esta página implica respaldo por su parte.
Cómo se presentan los datos. Las descripciones se muestran en su idioma original, tal como las publica la fuente. En los resultados de EUVD, el título se compone con los campos de fabricante y producto del propio registro. La gravedad se deriva de la puntuación CVSS publicada. La etiqueta «Maquinaria» y el filtro asociado son una clasificación orientativa de ENBRA. El estado de corrección refleja lo que indica el aviso en su última revisión. No se muestran los CVE rechazados, retirados o disputados.
Sin garantía. La información se ofrece tal cual, con fines informativos. Se actualiza de forma automática y puede contener errores, omisiones o datos no actualizados. Que un equipo no aparezca no significa que no tenga vulnerabilidades, y que aparezca no significa que tu instalación esté expuesta: depende de la versión, la configuración y la arquitectura de red. Esta página no es asesoramiento profesional ni sustituye una evaluación de riesgos de tu instalación. Consulta siempre el aviso original y las indicaciones del fabricante antes de actuar.
Marcas. Los nombres de fabricantes y productos pertenecen a sus respectivos titulares. Se citan únicamente para identificar los productos a los que se refiere cada aviso oficial.