4 articles tagged building-automation.
In one 48-hour window: fifteen CISA advisories covering the HVAC controllers, video servers and secure-networking appliances that run modern buildings, and a Shadowserver report putting nearly 300,000 routers and cameras into a botnet that now doubles as a residential proxy network. The two halves are the same story from opposite ends.
CISA's May 2026 ICS advisory release covers critical vulnerabilities across five major industrial and building automation vendors: Schneider Electric EcoStruxure Foxboro DCS, Advantech WebAccess/SCADA, Axis Communications security cameras, Rockwell Automation Micro820/850/870 controllers, and Mitsubishi Electric ICONICS products. The highest-severity advisory involves a CVSS 9.8 deserialization vulnerability in Schneider's DCS Advisor component. Combined, the advisories affect SCADA systems, IP cameras, PLCs, and building HMI software that are standard in smart office and industrial deployments.
A consolidated OT-ISAC advisory published in April 2026 documents critical flaws across industrial control and management systems including AVEVA supervisory platforms, Horner field controllers, Anviz access control hardware, and BASControl20 building automation systems. The advisory assigns a moderate exploitation risk within 30 to 90 days for exposed deployments — which describes a large share of smart building installations.
NIST's National Cybersecurity Center of Excellence has announced a new initiative focused on helping critical infrastructure organizations gain visibility into their operational technology environments. The project addresses a foundational problem that smart office and connected building operators face: most organizations do not have an accurate, current picture of what OT and IoT devices are on their networks or what those devices are doing.