CISA flags password-hash weakness in Rockwell OTTO Fleet Manager
CISA published an advisory on Rockwell Automation OTTO Fleet Manager, saying a bcrypt work-factor issue could make stored password hashes easier to crack if a backup is exposed.
CISA has issued a cybersecurity advisory for Rockwell Automation’s OTTO Fleet Manager after finding a password-hash weakness in versions through V2.36.2.
CISA said the flaw could make offline brute-force attacks against stored password hashes easier if an attacker gains access to an unencrypted system backup. The agency said the issue stems from an insufficient work factor in the bcrypt password-hashing implementation.
CISA identified the issue as CVE-2026-75112 and rated it medium severity. The advisory lists a CVSS v3.1 base score of 6.8 and a CVSS v4.0 base score of 6.9.
The advisory says the affected product is Rockwell Automation OTTO Fleet Manager, with the product status marked known affected. It says the product is used in the Critical Manufacturing and Transportation Systems sectors, is deployed worldwide and has headquarters in the United States.
CISA said Rockwell Automation addressed the vulnerability in software version 2.36.3. The advisory directs users to Rockwell Automation security advisory SD1791 for more information and for instructions on enabling encrypted system backup in OTTO Fleet Manager.
CISA also advises users to minimize network exposure for control system devices and systems, place control system networks behind firewalls and away from business networks, and use more secure remote access methods such as VPNs when remote access is required. The agency says VPNs should be kept updated to the most current version available.
CISA said no known public exploitation specifically targeting this vulnerability has been reported to the agency at this time. It also said the flaw is not exploitable remotely.
The advisory’s initial release date is Aug. 27, 2026, and the revision history notes an initial republication of Rockwell Automation SD1791 on that date.
Users who update to version 2.36.3 and follow the vendor’s backup guidance will have the fix and related instructions CISA points to in its advisory.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()