1732E ArmorBlock I/O CVE-2026-12655

The target 1732E ArmorBlock I/O module's embedded webserver must be enabled and network-reachable by the attacker; exploitation then requires no credentials because the flaw (CWE-294) lets the password be changed without authentication (PR:N, no UI). The primary limiting factor is network exposure: these modules are intended for segmented industrial control networks, so proper OT network segmentation that isolates the device web interface from untrusted networks substantially constrains who can reach and exploit it. No specific non-default product feature or configuration toggle is named in the description as a prerequisite.

Signals align toward genuine priority within affected environments but with important caveats. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and CWE-294 (Authentication Bypass by Capture-replay / spoofing) is consistent with the description's claim that the webserver password can be changed without valid credentials. Impact is scoped to integrity and availability (VC:N/VI:H/VA:H): an attacker does not read data but can seize the admin account and alter device configuration, matching the 8.8 severity. Critically, there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so the high CVSS reflects theoretical exploitability rather than observed exploitation - this is no public exploit identified at time of analysis, not confirmed active exploitation. The 'network' vector must be read in OT context: these are industrial distributed I/O modules normally deployed on segmented control networks, so real-world reach depends heavily on whether the device's web interface is exposed. Treat as a high-priority patch for exposed/flat OT networks and a lower-urgency item where the module is properly isolated.

An attacker with network reachability to a 1732E ArmorBlock I/O module's embedded webserver sends a crafted request that resets or sets the webserver password without providing any existing credentials, exploiting the authentication bypass. The attacker then logs in with the new password, takes over the admin account, and alters device I/O or configuration, potentially disrupting the industrial process. No public exploit code is identified in the available data, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description.