Rockwell Automation OTTO Fleet Manager: Weak bcrypt Hashes Put Credentials at Risk

Rockwell Automation has released an update for OTTO Fleet Manager to address a vulnerability that weakens password protection. The flaw, identified as CVE-2026-75112, is classified as CWE-916, "Use of Password Hash With Insufficient Computational Effort." In essence, the bcrypt hashes used to protect credentials are generated with a work factor that is too low. An attacker who manages to obtain an unencrypted system backup can thus carry out offline brute-force attacks with reduced computational cost.

The vulnerability was reported by Rockwell Automation to CISA and republished on August 27, 2026 in advisory Rockwell Automation SD1791. At this time there is no evidence of targeted public exploitation. Severity is medium: base score 6.8 according to CVSS v3.1 and 6.9 according to CVSS v4.0.

Less Robust Password Protection Than Expected

The core of the problem lies in the implementation of the bcrypt algorithm. Bcrypt is a hashing algorithm designed to be slow and computationally expensive, precisely to discourage attempts to guess passwords. Its computational cost depends on a parameter that defines the number of iterations. If this parameter, called the work factor, is set too low, hashes can be verified much more quickly than expected.

In OTTO Fleet Manager, the insufficient work factor allows an attacker to reduce the time needed to try millions of password combinations. This is not a vulnerability that allows bypassing authentication or executing arbitrary code. Rather, it makes the protection of stored passwords less robust, facilitating recovery of plaintext credentials. The CWE-916 classification highlights this weakness: use of a password hash with insufficient computational effort.

The Attack Chain: Local Access and Unencrypted Backups

Exploitation of the vulnerability is not possible remotely. According to the CVSS v3.1 vector, the attack requires adjacent network access, low privileges, and no user interaction. In practice, the attacker must already be on the organization's local network or have access to an adjacent device. Low privileges mean that a user with limited credentials can attempt the attack.

The critical point is represented by system backups. If an unencrypted backup of OTTO Fleet Manager is compromised, an attacker can extract the password hashes contained in it. With the weakened protection, the attacker can launch an offline brute-force attack to recover passwords. The concrete risk is compromise of credentials and consequent unauthorized access to the fleet management system. The condition of an unencrypted backup is key: without it, the attack has no material to work on.

Affected Versions and Impact on Critical Sectors

All versions of Rockwell Automation OTTO Fleet Manager up to and including V2.36.2 are affected. The fixed version is 2.36.3, available through the OTTO Motors file sharing portal at file-share.ottomotors.com/login.

The vulnerability primarily affects critical manufacturing and transportation systems sectors, with worldwide distribution. According to the CVSS v3.1 vector (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), the impact is high on confidentiality (C:H), while integrity and availability are not compromised. The scope change (S:C) indicates that the effect can extend beyond the vulnerable component. The CVSS v4.0 vector (CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) confirms high confidentiality on the vulnerable system and no impact on subsequent systems.

Mitigations: Update or Encrypt Backups

The primary mitigation is to update to OTTO Fleet Manager 2.36.3. For those who cannot apply the patch immediately, Rockwell Automation recommends following security best practices available at support.rockwellautomation.com and enabling encrypted system backup, as described in advisory Rockwell Automation SD1791.

CISA specifically recommends:

• Minimize network exposure for all control systems.
• Do not expose control systems directly to the Internet.
• Place ICS networks and remote devices behind firewalls.
• Isolate control networks from business networks.
• Use up-to-date VPNs for remote access.

Before applying countermeasures, an impact and risk analysis is recommended. These recommendations are standard for industrial environments and reduce the overall attack surface.

No Evidence of Active Exploitation

At this time, no public exploitation specifically targeting CVE-2026-75112 has been reported. The lack of circulating exploits reduces immediate risk, but does not eliminate the need to act. Systems using unencrypted backups are exposed to concrete risk, especially in industrial environments where network segmentation may not be perfect.

For support, Rockwell Automation provides OTTO Care (ottomotors.com/otto-care) and the company PSIRT at [email protected].