Rockwell Automation OTTO Fleet Manager: 1 CVE, Medium 6.8
Summary
CISA reports 1 vulnerability in Rockwell Automation OTTO Fleet Manager. Weakness type: Use of Password Hash With Insufficient Computational Effort. Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. Highest CVSS v3 score: 6.8 (Medium), exploitable from an adjacent network.
At a glance
- Vendor
- Rockwell Automation
- Products
- OTTO Fleet Manager
- CVEs
- CVE-2026-75112
- Highest CVSS v3
- 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-75112 | Use of Password Hash With Insufficient Computational Effort | 6.8 | – | No | A security issue exists within OTTO Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup, the weakly hashed credentials could… |
Affected products (1)
- Rockwell Automation OTTO Fleet Manager: <=V2.36.2
Vendor fixes and mitigations (from advisory)
- Mitigation: Rockwell Automation has addressed this vulnerability in software version 2.36.3. link
- Mitigation: Users of the affected software who are not able to upgrade to the corrected version or apply the mitigations should use Rockwell Automation's security best practices. link
- Vendor Fix: See Rockwell Automation security advisory SD1791 for more information about this issue and instructions to enable encrypted system backup in OTTO Fleet Manager. link
- Mitigation: If you have any questions regarding the security issue(s) above and how to mitigate them, contact Rockwell Automation support. link
- Mitigation: If you have any questions regarding this disclosure, please email Rockwell Automation PSIRT: rasecure@ra.rockwell.com link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.