The week of 11 August 2026 gave connected-office operators an unusually clean before-and-after. On Wednesday 13 August, CISA published fifteen industrial control systems advisories as part of the month’s ICS Patch Tuesday — an unusually building-heavy set, with Siemens alone shipping ten new advisories alongside Schneider Electric and Phoenix Contact. On Thursday 14 August, the Shadowserver Foundation published a special report on the Dysphoria botnet, documenting roughly 296,000 compromised devices: routers, gateways, IP cameras and other embedded Linux systems.
One day of vulnerabilities in the systems that run buildings. The next day, a census of what happens to devices like them when nobody patches. Worth reading together.
The Advisories That Matter for an Office
Of the fifteen, five sit squarely inside the modern building stack.
Johnson Controls Metasys — CVE-2026-34491 (ICSA-26-225-14)
Metasys is the building management system: HVAC, lighting, energy, the graphical floor plans facilities staff click through all day. The flaw is a cross-site scripting issue (CWE-79) in the Metasys UI. A low-privilege user — or an attacker who has obtained low-privilege access — can inject a persistent payload via a crafted URL that then executes in the context of other users’ sessions, including administrators. The outcome is session hijacking and unauthorised access. Metasys 12 and Metasys 13 are affected.
XSS in a BMS reads as low-drama until you map the privilege gradient. BMS deployments hand out read-only or single-building logins liberally — to tenants, to contractors, to energy consultants, to the night facilities team. Those accounts exist precisely because they are supposed to be harmless. This bug converts any one of them into a path to a full BMS administrator session, and BMS administrators can change setpoints, schedules, and alarm thresholds across a whole portfolio.
Siemens Desigo DXR and PXC controllers — CVE-2026-59693 (ICSA-26-225-08)
A malformed BACnet packet causes the controller to stop responding to BACnet queries. Recovery requires a device reset or reboot. Affected: Desigo DXR2 and PXC3 below 01.21.233.16-7862, and PXC4, PXC5.E003, PXC5.E24 and PXC7 below 02.21.194.36-2715. CISA lists commercial facilities, critical manufacturing, energy, healthcare and transportation as affected sectors.
A denial of service on a room controller sounds like an inconvenience. In a building, availability is the safety property. These are the devices holding air handling, ventilation rates, and temperature control for occupied floors. And BACnet is the relevant detail: it is an unauthenticated broadcast-friendly protocol that assumes the network it runs on is trusted. Anything that can put a packet on the BACnet segment can send this one — which is a network segmentation question, not a patching question.
Siemens Siveillance Video — CVE-2026-3014 (ICSA-26-225-09)
Remote code execution in the video management servers. Affected: Siveillance Video V2023 R3 below 23.3.27, V2024 R1 below 24.1.16, and V2025 below 25.1.15. Siemens has released fixed versions.
The VMS is the aggregation point for every camera in the building — the one host that holds all the footage, all the camera credentials, and network reachability to every camera on the estate. Code execution there is worth more to an attacker than code execution on any individual camera, for the same reason the RMM compromise we covered last week was worth more than any individual endpoint.
Johnson Controls Airwall — CVE-2026-64887, CVE-2026-34492 (ICSA-26-225-03)
Airwall is the product organisations buy specifically to segment and micro-isolate OT networks — the mitigation, in other words, that every advisory above recommends. The advisory covers hard-coded cryptographic keys (CVE-2026-64887) and a file path validation flaw enabling arbitrary file read (CVE-2026-34492). The guidance is to apply v4.1.0 or later to all Airwalls.
Hard-coded keys in a segmentation product is a particular kind of bad news, and it is the same defect class that dominated June’s IoT advisories. Security appliances are not exempt from the failure modes they exist to contain.
Haiwell IoT Cloud HMI Gateway — CVE-2026-19188 (ICSA-26-225-02)
An OS command injection in the Net Check feature reachable via the /setting endpoint: the cmdPing Socket.io event fails to sanitise user input before passing it to the operating system, giving arbitrary command execution with root privileges. Affected version 3.40.1.12.
This is the cheap-gateway pattern — an HMI, IoT gateway and DTU in one inexpensive box — and it is the sort of device that turns up in a building because an integrator needed to get a legacy panel onto a network cheaply. A ping utility in a web UI that shells out without sanitising is a vulnerability class that predates most of the people deploying these devices.
Dysphoria: What Unpatched Looks Like at Scale
The next day’s Shadowserver report is the other end of that pipeline.
Roughly 296,000 devices. Routers, gateways, IP cameras, embedded Linux systems. Shadowserver’s dataset includes IPs, ports, protocols, geography, network details, device vendors and models, and first/last-seen timestamps — which is to say it is directly actionable if you subscribe to their reporting for your own address space, and most organisations should.
The initial access is not exotic: password attacks against Telnet and SSH, alongside known flaws. No named zero-day. Just credentials that were never changed and firmware that was never updated, at scale.
What makes Dysphoria worth attention beyond the raw number is a capability the operators recently added. Alongside DDoS, the botnet now functions as a C2 relay and residential proxy network — the operators route their own traffic through infected devices to mask its origin. That changes the risk calculus for an organisation whose device gets recruited, and it changes it in a direction most risk registers have not accounted for.
If a camera on your guest VLAN is enrolled, your organisation is no longer only contributing bandwidth to someone else’s DDoS. Your corporate IP address is now the apparent origin of someone else’s intrusion traffic, credential stuffing, or command-and-control. The consequences are reputational (block lists), operational (your address space getting filtered by partners), and legal (you are the party the abuse complaint reaches). DDoS participation is a bandwidth bill. Being a proxy exit node is an attribution problem.
And because these devices sit on residential and small-business connections, mitigation is genuinely hard for defenders downstream. That is the design goal — the same thinking that drove the Aisuru-class record-breaking attacks earlier this year and the DoJ takedowns that followed. Enforcement removes infrastructure; it does not remove the population of reachable, default-credentialed devices, so a successor appears within months. Dysphoria is that successor.
Reading the Two Halves Together
The advisories describe devices that are managed, branded, supported, and have vendors shipping patches. The botnet describes devices that are none of those things. The gap between them is not technology — a Desigo controller and a compromised gateway are both embedded Linux on a network. The gap is ownership.
Every device in the Shadowserver dataset was, at some point, a device someone installed on purpose and then stopped thinking about. In offices, that transition usually happens at a specific moment: the integrator’s warranty ends, the person who commissioned the system leaves, or the building changes tenants. Nothing about the device changes. It simply stops having an owner, and its firmware freezes at whatever version shipped.
The Action List
- Patch the five above, in this order: Siveillance Video (RCE, aggregation point) → Airwall (it is your segmentation control) → Haiwell gateway (unauthenticated root) → Metasys (privilege escalation via any low-priv account) → Desigo (availability, and mitigable by segmentation in the meantime).
- Treat the BACnet segment as trusted-by-design and firewall accordingly. The Desigo DoS is exploitable by anything that can reach the BACnet network. Layer 3 boundaries with explicit allowlists, and no path from guest or general corporate Wi-Fi.
- Audit low-privilege BMS accounts. The Metasys XSS turns tenant, contractor and consultant logins into stepping stones. Enumerate every account, remove the dormant ones, and confirm nobody shares a login between organisations.
- Subscribe to Shadowserver’s free reporting for your netblocks. If a device of yours is in the Dysphoria dataset, this is how you find out — before a partner’s abuse desk tells you.
- Change the default credentials on everything reachable over Telnet or SSH, and turn Telnet off. This is the most boring instruction in security and it is the one that would have prevented most of 296,000 compromises.
- Set an owner and an end-of-support date for every building device at commissioning. Not at the next audit. The failure mode is not devices without patches; it is devices without people.
The August advisories are the manufacturers doing their part of the job. Dysphoria is the running total of everyone who did not do theirs. With the CRA’s reporting obligations three and a half weeks out, the vendor half of that equation is about to become legally enforceable. The operator half stays exactly where it has always been.
