Armatura One CVE-2026-94594

Exploitation requires read access to the Armatura One message broker's operational log file, or to any backup archive or diagnostic/support bundle that includes that log - the credentials and password are written there in plain text during normal operation, so no special product feature must be enabled. Limiting factors: the attack is local (AV:L), not network-exploitable, meaning the attacker must already be able to read the host filesystem or obtain an exported log/backup/support bundle; risk is amplified in practice when support bundles are shared with the vendor or third parties, since that extends who can read the credential beyond the host itself.

This is a low-to-moderate priority issue whose real-world risk is constrained by the local attack vector. The provided CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.0) indicates a local, low-complexity attack affecting confidentiality only, with no integrity or availability impact - consistent with a CWE-532 plaintext-credential-in-logs weakness. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; this flaw is not a candidate for mass automated exploitation because it requires access to the log, backup, or support bundle first. One tension worth flagging: the CVSS vector sets PR:N (no privileges), yet the description states exploitation requires 'read access to this log, or to a backup or support bundle' - obtaining that read access generally implies some level of local access or privilege, so PR:N arguably understates the precondition and should be verified against the vendor advisory. The logged credential also enables follow-on lateral movement (the harvested password may unlock the message broker or connected devices), so impact may be understated as C:L if the exposed credential is high-value. Overall: a defense-in-depth hardening fix rather than an urgent emergency, but relevant in OT/ICS environments where support bundles are routinely shared with vendors.

An attacker or insider with read access to the Armatura One host filesystem, or someone who receives a diagnostic/support bundle or backup archive, opens the message broker log and reads the client connection credentials and password stored in plain text. No public exploit code is needed - the credential is simply present in the log and can be reused to authenticate to the broker or connected systems. Because the CVSS vector is AV:L, this requires local or equivalent access to the log data rather than a remote network request.