OTTO Fleet Manager CVE-2026-75112

Exploitation requires two sequential prerequisites: (1) the attacker must obtain an unencrypted system backup of the OTTO Fleet Manager instance, which requires either physical access to backup media, access to an unprotected backup storage location on the adjacent network, or a prior compromise enabling backup exfiltration; and (2) the attacker must have sufficient compute resources to run offline brute-force against bcrypt hashes. Exploitation is limited by the Adjacent attack vector - a purely remote internet-based attacker cannot directly reach the backup without traversing network segmentation. The CVSS PR:L metric indicates some level of existing access is required to reach the backup. Exploitation does NOT require interaction with the running application and is entirely offline once the backup is in hand. No special application feature needs to be enabled - the vulnerability is in the baseline credential storage configuration.

The CVSS 4.0 score of 6.9 reflects a realistic threat model: AV:A limits exposure to adjacent-network attackers, PR:L requires some existing access level to obtain a backup, and the impact is confidentiality-only (VC:H, VI:N, VA:N), consistent with credential disclosure rather than direct system compromise. No EPSS data was provided in the intelligence feed, and the vulnerability carries no CISA KEV listing and no public proof-of-concept, which collectively suggest it has not yet been observed in active exploitation campaigns. The real-world risk is substantially conditional: an attacker must first obtain an unencrypted system backup, a step that itself requires either physical access, network access to backup storage, or a separate initial compromise. The CVSS Adjacent vector is appropriate given the OT/industrial deployment context of AMR fleet systems. Organizations should prioritize this in environments where backup media is poorly protected or transmitted unencrypted across network segments - the weak hashing transforms what would otherwise be an inert backup file into a practical credential recovery opportunity. SSVC signals suggest Defer-to-Scheduled patching priority absent evidence of backup exfiltration.

An attacker with low-level access to the OT network segment hosting OTTO Fleet Manager obtains an unencrypted system backup - for example, from an unsecured NAS share or removable media used during maintenance. They extract the password hash database from the backup and use a GPU-accelerated tool such as Hashcat to crack the bcrypt hashes at a rate substantially faster than a properly tuned cost factor would allow, recovering plaintext credentials for operator or administrator accounts. No public proof-of-concept targeting this specific implementation has been identified at time of analysis.