Rockwell Automation OTTO Fleet Manager Flaw Enables Offline Brute-Force Attacks on Password Hashes

Rockwell Automation has disclosed a vulnerability in its OTTO Fleet Manager, a fleet management solution used in critical manufacturing and transportation sectors. The flaw, tracked as CVE-2026-75112, arises from the use of an insufficient work factor in the bcrypt password hashing implementation. This weakness reduces the computational effort required for an attacker to perform offline brute-force attacks against stored password hashes, potentially compromising credentials if an unencrypted system backup is obtained.

The vulnerability affects OTTO Fleet Manager versions up to and including V2.36.2. According to the advisory, successful exploitation could allow an attacker with access to an unencrypted backup to more easily crack password hashes, leading to unauthorized access to the system. The CVSS v3.1 base score is 6.8 (medium), with a vector of CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating an adjacent network attack vector and high confidentiality impact.

Rockwell Automation has addressed the issue in software version 2.36.3. The vendor also provides guidance in security advisory SD1791 on enabling encrypted system backup to mitigate the risk. Users who cannot upgrade immediately are advised to follow Rockwell's security best practices and minimize network exposure of control system devices.

CISA, which published the advisory, notes that the vulnerability is not known to be actively exploited. However, given the critical infrastructure sectors involved, organizations are urged to apply the patch or implement mitigations promptly.