EUVD-2026-62694
GHSA-4xvh-cw62-mf4j
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and low privileges reflect backup access precondition; confidentiality-only impact matches credential disclosure with no integrity or availability consequence.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup, the weakly hashed credentials could be more easily compromised.
AnalysisAI
Weak bcrypt work factor in Rockwell Automation OTTO Fleet Manager exposes stored password hashes to accelerated offline brute-force attacks when an attacker gains access to an unencrypted system backup. All versions covered by CPE cpe:2.3:a:rockwell_automation:otto®_fleet_manager:* are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential prerequisites: (1) the attacker must obtain an unencrypted system backup of the OTTO Fleet Manager instance, which requires either physical access to backup media, access to an unprotected backup storage location on the adjacent network, or a prior compromise enabling backup exfiltration; and (2) the attacker must have sufficient compute resources to run offline brute-force against bcrypt hashes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 reflects a realistic threat model: AV:A limits exposure to adjacent-network attackers, PR:L requires some existing access level to obtain a backup, and the impact is confidentiality-only (VC:H, VI:N, VA:N), consistent with credential disclosure rather than direct system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-level access to the OT network segment hosting OTTO Fleet Manager obtains an unencrypted system backup - for example, from an unsecured NAS share or removable media used during maintenance. They extract the password hash database from the backup and use a GPU-accelerated tool such as Hashcat to crack the bcrypt hashes at a rate substantially faster than a properly tuned cost factor would allow, recovering plaintext credentials for operator or administrator accounts. … |
| Remediation | The primary remediation is to apply any update released by Rockwell Automation that increases the bcrypt work factor to a value meeting current NIST or OWASP recommendations (cost factor 10 or higher for bcrypt). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today