CISA Warns of Unpatched Avation & RISS Critical Flaws

CISA warns of two critical, unpatched vulnerabilities in OT devices—Avation Light Engine Pro (CVE-2026-1341, CVSS 9.8) and RISS SRL MOMA Seismic Station (CVE-2026-1632, CVSS 9.1)—which expose web/configuration interfaces without authentication, allowing unauthenticated attackers to take full control or disrupt/disable monitoring; both vendors did not respond to coordination requests and users are advised to isolate affected devices behind strict firewalls and VPNs.