ZeroHour

CVE-2026-75112

niche

Insufficient bcrypt Work Factor Weakens Passwords in Rockwell OTTO Fleet Manager

CVSS 4.0
6.9 medium
EPSS
<1%p2
Published
()
Modified
AI analysis

CVE-2026-75112 is a weak password-hashing flaw (CWE-916) in Rockwell Automation's OTTO Fleet Manager, caused by an insufficient work factor in its bcrypt implementation that lowers the computational cost required to crack stored password hashes. The issue is triggered when an attacker obtains an unencrypted system backup that contains the weakly hashed user credentials. With that backup in hand, the attacker can conduct offline brute-force or dictionary attacks far more cheaply than expected, potentially recovering passwords and gaining access to the Fleet Manager system (confidentiality-only impact, per the CVSS 4.0 score of 6.9 with VC:H and no integrity or availability impact). Affected users are deployments of OTTO Fleet Manager whose stored password hashes use the insufficient work factor; the available data does not specify affected or fixed version ranges. No exploitation is known at this time: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.1% probability of exploitation within the next 30 days.

What to do: Monitor Rockwell Automation's security advisory/knowledge base article for CVE-2026-75112 and update OTTO Fleet Manager to the patched release once the vendor publishes fixed version details. In the meantime, encrypt system backups (or restrict access to them) so stored password hashes cannot be harvested for offline cracking, and limit adjacent network and low-privileged access to Fleet Manager. If any unencrypted backup has been exposed or shared, rotate affected user credentials and ensure strong, unique passwords are in use.

Affected
Rockwell Automation OTTO Fleet Manager
Estimated exposure
nichelikely hundreds to low-thousands of sites (estimate; no public install counts available) — OTTO Fleet Manager is a niche industrial fleet-management product deployed per facility alongside OTTO Motors autonomous mobile robots, so the installed base is plausibly in the hundreds to a few thousand sites, though no public…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup, the weakly hashed credentials could be more easily compromised.

Weakness
CWE-916
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

In the news

Rockwell Automation OTTO Fleet Manager

CISA warns Rockwell Automation OTTO Fleet Manager (CVE-2026-75112, CVSS 6.8) uses insufficiently costly password hashing, easing offline brute-force attacks.

CISA published ICS advisory ICSA-26-239-03 for Rockwell Automation OTTO Fleet Manager versions 2.36.2 and earlier (CVE-2026-75112, CVSS v3 6.8). The flaw involves use of a password hash with insufficient computational effort, reducing the cost for an attacker to perform offline brute-force attacks against stored password hashes. Deployments span critical manufacturing and transportation systems sectors worldwide, with company headquarters in the United States.

CISA Advisories · 19d agoAdvisoryCVE-2026-75112