AI analysis
CVE-2026-75112 is a weak password-hashing flaw (CWE-916) in Rockwell Automation's OTTO Fleet Manager, caused by an insufficient work factor in its bcrypt implementation that lowers the computational cost required to crack stored password hashes. The issue is triggered when an attacker obtains an unencrypted system backup that contains the weakly hashed user credentials. With that backup in hand, the attacker can conduct offline brute-force or dictionary attacks far more cheaply than expected, potentially recovering passwords and gaining access to the Fleet Manager system (confidentiality-only impact, per the CVSS 4.0 score of 6.9 with VC:H and no integrity or availability impact). Affected users are deployments of OTTO Fleet Manager whose stored password hashes use the insufficient work factor; the available data does not specify affected or fixed version ranges. No exploitation is known at this time: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.1% probability of exploitation within the next 30 days.
What to do: Monitor Rockwell Automation's security advisory/knowledge base article for CVE-2026-75112 and update OTTO Fleet Manager to the patched release once the vendor publishes fixed version details. In the meantime, encrypt system backups (or restrict access to them) so stored password hashes cannot be harvested for offline cracking, and limit adjacent network and low-privileged access to Fleet Manager. If any unencrypted backup has been exposed or shared, rotate affected user credentials and ensure strong, unique passwords are in use.
Affected
| Rockwell Automation OTTO Fleet Manager | — |
Estimated exposure
nichelikely hundreds to low-thousands of sites (estimate; no public install counts available) — OTTO Fleet Manager is a niche industrial fleet-management product deployed per facility alongside OTTO Motors autonomous mobile robots, so the installed base is plausibly in the hundreds to a few thousand sites, though no public…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup, the weakly hashed credentials could be more easily compromised.