OT Security Weekly DACH, KW 45/2026: Remote Maintenance in Focus

The overall OT threat level for DACH (Germany, Austria, Switzerland) is high in KW 45/2026. The most important incident this week is the attacks on refrigeration systems in German supermarkets. According to dpa/Handelsblatt, in one affected case (Wetter-Volmarstein) the actual attack hit the company that maintains the cooling systems remotely; for the other locations no attack path has been published. At the same time, attackers are exploiting edge devices at the boundary between IT and OT: Siemens SIMATIC IoT2050 Advanced with Node-RED and Zyxel GS1900 switches. Ivanti Connect Secure users should also check that they have installed the patch Ivanti released on October 29.

Key developments this week

• Supermarket refrigeration attacked, in one case via the remote maintenance provider. According to dpa/Handelsblatt (Nov 3), refrigeration systems in German supermarkets were apparently manipulated remotely, among others in Lilienthal, Wuppertal, Wetter-Volmarstein, Reisbach (Lower Bavaria), Raesfeld (Münsterland) and the districts of Kaiserslautern and Kusel. For Wetter-Volmarstein the report says the actual attack was on the firm that maintains the refrigeration systems remotely. For the other locations the article names no attack path. Handelsblatt. SANS ICS Critical Control: CC4 Secure Remote Access.
• Joint US advisory on refrigeration and cold-chain monitoring. On November 5, CISA, FBI, HHS, USDA and the Department of Transportation published a joint call to harden refrigeration controllers and cold-chain monitoring. Core points: no controller panels on the internet, remote access only behind an up-to-date firewall, OT on a dedicated VLAN, no default passwords, phishing-resistant MFA where feasible, and alerts on setpoint deviations. CISA. CC4 Secure Remote Access.
• Siemens SIMATIC IoT2050 Advanced: Node-RED flaw exploited (CVE-2026-58115, CVSS 10.0). The missing-authentication flaw affects IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens fixed it in August (SSA-834709); VulnCheck has observed exploitation attempts against its honeypots since October 30. Fix: Node-RED 4.3.4.1 or later, or remove Node-RED. The Hacker News. CC5 Risk-Based Vulnerability Management.
• Zyxel GS1900 zero-day (CVE-2026-107441). According to BleepingComputer (Nov 4, citing GreyNoise), attackers compromised 996 switches in 48 countries through an out-of-bounds write in the web management interface of ten GS1900 models. Zyxel released new firmware on October 22. BleepingComputer. CC5 Risk-Based Vulnerability Management.
• Siemens Industrial Edge: Brotli vulnerability (SSA-443410, CVE-2026-111497, CVSS 9.8). Affected are both management applications on the IEM and device applications on the edge devices. Updates exist for Cloud Connector Configurator (V1.24.3), Databus Configurator (V4.0.1), DataXess Configurator (V1.5.7), Edge OPC UA Server Configurator (V2.3.10), Flow Creator Configurator (V1.15.1) and Data Flow Monitoring (V3.0.18). There is no fix yet for Common Configurator: on the device (CC on Edge) Siemens says to stop it; on the IEM, uninstall all management applications and protect the IEM with a firewall/WAF. If no management applications are installed, nothing needs to be done on the IEM side; check device applications separately. Industrial Edge Hub and IEM Cloud are fixed centrally. Siemens ProductCERT. CC5 Risk-Based Vulnerability Management.
• Follow-up: Ivanti Connect Secure. Volexity documented a chain of zero-days on October 13 (CVE-2026-104935, CVE-2026-111357) that allowed unauthenticated root code execution. The patch for the privilege escalation part (CVE-2026-111357) followed on October 29. Anyone who patched only in mid-October still needs that update. Volexity. CC4 Secure Remote Access.

What it means per sector

Power & grids (threat level: elevated). In KW 45 there was no publicly known attack on grid control systems, protection systems or substations in DACH. The risk is at the edges: Ivanti Connect Secure, SIMATIC IoT2050 Advanced with Node-RED and Zyxel GS1900. At municipal utilities, these devices often sit exactly where remote maintenance and data links lead into OT. Full report (German)

Food & beverage (threat level: high). This week is about the cold chain. According to dpa, refrigeration controllers in German supermarkets were apparently manipulated remotely, and food had to be thrown away. According to The Hacker News, a Danfoss spokesperson told the Dutch broadcaster NOS that the affected stores there were not on a secure network and still used default passwords (The Hacker News). Full report (German)

Machine builders (threat level: elevated). SIMATIC IoT2050 Advanced is a gateway of the kind found in many machines, and its Node-RED flaw is now being exploited. In the refrigeration attacks, one German case points to the company that maintains the systems remotely. That matters to every OEM and integrator that runs remote access to customer plants: one compromised service account can reach many customers at once. Full report (German)

What to do now

• Lock down vendor remote access (CC4, immediately): List all remote access paths used by service providers (refrigeration, filling, packaging, building services). End permanent connections and allow access only on request, with MFA and logging through a Jump Host. Ask providers in writing whether they are affected and which credentials they store for your systems.
• For OEMs and integrators (CC4, immediately): Harden your remote maintenance platform with MFA, customer approval per session, separate credentials per customer and log reviews. Stop sharing service credentials across customers.
• Patch and isolate edge devices (CC2/CC5): Search your asset inventory for IoT2050 Advanced with Node-RED and GS1900. Update Node-RED to 4.3.4.1 or remove it; update the GS1900 firmware, expose the web UI only from a management VLAN and change every password that was in the switch configuration. On Ivanti Connect Secure, install the October 29 patch and renew all credentials and sessions used through the gateway. Handle Industrial Edge according to SSA-443410 (including CC on Edge and Data Flow Monitoring) and separate the IEM from the rest of the network.
• Segment refrigeration and remote maintenance systems (CC2, 0 to 3 months): Put them in their own network zone, separate from the office network. Replace unsupported devices.
• Build network visibility and run an IR exercise (CC3/CC1, 0 to 3 months): Monitor traffic between IT and OT so Lateral Movement and Webshells are detected. Run an Incident Response exercise for an extortion scenario with data exfiltration, including the NIS2 notification.

Full sector reports (German)

• All sectors (DACH overview)
• Power & grids
• Utilities (water, wastewater, municipal)
• Food & beverage production
• Machine builders (CRA)
• All sectors at a glance

Max Gilg is an OT cybersecurity consultant based in Rosenheim, Germany (OT-Cyber.de).