Banned Under NDAA Section 889, but Still on Your xOT Network
Summary: NDAA Section 889 bans federal agencies and contractors from procuring or using telecom and video surveillance equipment from Huawei, ZTE, Hytera, Hikvision, and Dahua, with the procurement ban effective August 13, 2019 and the use ban a year later. The use ban follows the entire enterprise network of any organization holding a federal contract, and the article notes that rebranded or OEM hardware built on those platforms carries the same firmware and vulnerabilities regardless of the name on the case.
What's compelling: The article cites Operation CameraSwarm, which compromised more than 14,530 Dahua devices between mid-June and late July 2026 and planted a persistent account on at least 1,923 cameras that reportedly survived a factory password reset. It also cites Volt Typhoon maintaining undetected access to a single U.S. critical infrastructure network for five years, which is the kind of pre-positioning a banned device sitting unnoticed on your network already supports.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026