Rockwell Automation OTTO Fleet Manager
CISA warns Rockwell Automation OTTO Fleet Manager (CVE-2026-75112, CVSS 6.8) uses insufficiently costly password hashing, easing offline brute-force attacks.
CISA published ICS advisory ICSA-26-239-03 for Rockwell Automation OTTO Fleet Manager versions 2.36.2 and earlier (CVE-2026-75112, CVSS v3 6.8). The flaw involves use of a password hash with insufficient computational effort, reducing the cost for an attacker to perform offline brute-force attacks against stored password hashes. Deployments span critical manufacturing and transportation systems sectors worldwide, with company headquarters in the United States.
- CVE-2026-75112 (CVSS 6.8): password hash with insufficient computational effort
- Flaw eases offline brute-force attacks against stored password hashes
- Affects OTTO Fleet Manager 2.36.2 and earlier, deployed worldwide
- CVEs
- CVE-2026-75112
- Vendors
- Rockwell Automation
- Products
- OTTO Fleet Manager
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75112 | Insufficient bcrypt Work Factor Weakens Passwords in Rockwell OTTO Fleet Manager | 6.9 | <1% |
From the original article
View CSAF Summary Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. The following versions of Rockwell Automation OTTO Fleet Manager are affected: OTTO Fleet Manager <=V2. 36.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.