4 articles tagged Cyber-Resilience-Act.
On 11 September the EU Cyber Resilience Act's reporting obligations switch on: 24 hours for an early warning, 72 for a full notification, 14 days after a fix for the final report. Almost every guide is written for manufacturers. If you buy and operate devices rather than make them, here is what actually changes — and the six questions to add to procurement this month.
A format string bug in a camera's JSON parser gives an unauthenticated attacker root. The vendor took a year and still had no fix when the advisory dropped. The uncomfortable part isn't the bug — it's that the vulnerable binary was written by a different company than the one on the box, and nobody in your office knows which brands share it.
In two weeks, CISA published three IoT advisories covering smart doorbells, cameras and a yard robot — every headline flaw a hardcoded or default credential. Acer shipped fixes for two CVSS 10.0 mesh-router zero-days, Cisco confirmed active exploitation of an SD-WAN Manager flaw, and a multi-agency advisory warned of attacks on internet-exposed fuel-tank gauges. All of it lands as the EU Cyber Resilience Act's 24-hour reporting clock counts down to September 11.
From September 11, 2026, manufacturers of connected products sold in the EU must report actively exploited vulnerabilities to ENISA within 24 hours. The obligation reaches routers, cameras, smart-building devices and OT, carries fines up to €15 million or 2.5% of global turnover, and reshapes how buyers should evaluate vendors. With roughly 90 days to go, two-thirds of vendors say they are still unfamiliar with the regulation.