1732E Armorblock I O
Monthly
Network storm traffic directed at Rockwell Automation 1732E ArmorBlock I/O modules can exhaust device resources and interrupt communications, causing the module to fault and stop responding on its open TCP and UDP ports; recovery requires a manual power cycle. The CPE data covers the 1732E ArmorBlock I/O product line broadly, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor score 8.7 under CVSS 4.0) confirms this is an unauthenticated, remote, availability-only condition with no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, so the realistic risk is concentrated in OT/ICS environments where these field devices are reachable from flat or untrusted networks, especially where a power cycle requires physical site access.
Unauthenticated modification of the embedded webserver password on Rockwell Automation 1732E ArmorBlock I/O modules allows any network-reachable attacker to seize the administrative account and alter device configuration. The flaw is rated 8.8 (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H, no confidentiality impact), matching an authentication-bypass class (CWE-294) and confirmed by the independent assessment as CVSS:3.1 AV:N/AC:L/PR:N/UI:N with C:N/I:H/A:H. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and real-world exposure depends on whether the module's webserver is reachable from untrusted networks rather than being contained by OT segmentation.
Network storm traffic directed at Rockwell Automation 1732E ArmorBlock I/O modules can exhaust device resources and interrupt communications, causing the module to fault and stop responding on its open TCP and UDP ports; recovery requires a manual power cycle. The CPE data covers the 1732E ArmorBlock I/O product line broadly, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor score 8.7 under CVSS 4.0) confirms this is an unauthenticated, remote, availability-only condition with no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, so the realistic risk is concentrated in OT/ICS environments where these field devices are reachable from flat or untrusted networks, especially where a power cycle requires physical site access.
Unauthenticated modification of the embedded webserver password on Rockwell Automation 1732E ArmorBlock I/O modules allows any network-reachable attacker to seize the administrative account and alter device configuration. The flaw is rated 8.8 (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H, no confidentiality impact), matching an authentication-bypass class (CWE-294) and confirmed by the independent assessment as CVSS:3.1 AV:N/AC:L/PR:N/UI:N with C:N/I:H/A:H. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and real-world exposure depends on whether the module's webserver is reachable from untrusted networks rather than being contained by OT segmentation.