CISA ICSA-26-090-01: Anritsu Remote Spectrum Monitor Missing Authentication Vulnerability

Vulnerability Summary: Anritsu Remote Spectrum Monitor Vulnerability Overview Vulnerability Name: Anritsu Remote Spectrum Monitor Alert Code: ICSA-26-090-01 Publication Date: March 31, 2026 CVSS Score: v3 9.8 Vulnerability Type: Missing Authentication for Critical Function Impact Description: Successful exploitation of this vulnerability could allow an attacker with network access to modify operational settings, obtain sensitive signal data, or disrupt device availability. Exploitation Status: To date, there are no known public exploit reports for this vulnerability. Affected Systems All versions of the Anritsu Remote Spectrum Monitor are affected, specifically including: Remote Spectrum Monitor MS27100A vers.all/ Remote Spectrum Monitor MS27101A vers.all/ Remote Spectrum Monitor MS27102A vers.all/ Remote Spectrum Monitor MS27103A vers.all/ Associated CVE: CVE-2026-3356 Deployment Context: Critical Infrastructure Sectors: Communications, Defense Industrial Base, Emergency Services, Transportation Systems. Deployment Region: Global. Vendor Headquarters: Japan. Remediation (Recommended Practices) CISA recommends the following defensive measures to minimize the risk of exploitation: 1. Minimize Network Exposure: Ensure all control system devices/systems are not accessible from the internet. 2. Network Segmentation: Place control system networks and remote devices behind firewalls and isolate them from enterprise networks. 3. Secure Remote Access: When remote access is required, use more secure methods (such as Virtual Private Networks/VPNs). Note that VPNs themselves may contain vulnerabilities; ensure they are updated to the latest versions, and recognize that VPN security depends on the security of the connected devices. 4. Risk Assessment: Conduct appropriate impact analysis and risk assessment before deploying defensive measures. 5. Reference Best Practices: Refer to control system security recommended practices and technical information documents (ICS-TIP-12-146-01B) on the CISA ICS webpage (cisa.gov/ics). 6. Monitoring and Reporting: Organizations should follow established internal procedures and report observed suspicious malicious activities to CISA for tracking and correlation.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-090-01: Anritsu Remote Spectrum Monitor Missing Authentication Vulnerability

More from this source