Armatura One
Monthly
Armatura One and Armatura One (USA) installations that enable the optional AES-128-CBC credential protection store database and message-broker credentials under a hard-coded key and IV embedded in the software, so an attacker who has the installation package and separately obtains a target's encrypted install configuration file can decrypt those credentials. The independent assessment scores this as 8.6 but emphasizes a local attack vector: it is not remotely triggerable and requires prior access to the victim's configuration file, with no privileges required (PR:N) but a local prerequisite (AV:L). No public exploit identified at time of analysis.
Armatura One ships with a fixed, vendor-defined password assigned to its database superuser account during database initialization, so it is identical across installations unless an administrator has changed it. Anyone who already has access to the underlying host operating system and knows this value can authenticate to the database as the superuser on any deployment where the default has not been rotated. The flaw is rated 8.6 under CVSS 4.0 (assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), requires local OS-level access rather than a network path, requires no user interaction or application-level authentication, and there is no public exploit identified at time of analysis; exploitation is fully prevented on systems where the superuser password has been reset.
Armatura One's backup and restore routine writes the complete database connection command - including the database superuser password in plaintext - into a log file stored on the host, so anyone able to read that log recovers credentials sufficient to take full control of the backend database. Exploitation is access-gated: it requires local access to the server operating system (CVSS vector AV:L/PR:L), the privilege to read the affected log, and a prior backup or restore operation to have actually populated the file with the credential, which makes the realistic risk post-compromise privilege escalation or insider abuse rather than remote attack. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue has been published through CISA's ICS advisory program (ICSA-26-274-01), indicating deployments in operational-technology and physical-security environments.
Cleartext credential disclosure in the Armatura One message broker causes client connection credentials and their associated passwords to be written to the broker's operational log in plain text during normal operation, so anyone who can read that log - or a backup or diagnostic/support bundle containing it - obtains a usable credential. The exposure is local rather than network-reachable: per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) an attacker must already have low-privileged read access to the host filesystem or to an exported log, backup, or support bundle, and there is no public exploit identified at time of analysis. Assignment of CWE-532 means the credential never needs to be decrypted or brute-forced; the weakness is simply that the protocol exchanges are logged verbatim, which is why this is rated a low-to-moderate priority issue whose practical blast radius depends on how widely logs and support bundles are copied and shared.
Armatura One and Armatura One (USA) installations that enable the optional AES-128-CBC credential protection store database and message-broker credentials under a hard-coded key and IV embedded in the software, so an attacker who has the installation package and separately obtains a target's encrypted install configuration file can decrypt those credentials. The independent assessment scores this as 8.6 but emphasizes a local attack vector: it is not remotely triggerable and requires prior access to the victim's configuration file, with no privileges required (PR:N) but a local prerequisite (AV:L). No public exploit identified at time of analysis.
Armatura One ships with a fixed, vendor-defined password assigned to its database superuser account during database initialization, so it is identical across installations unless an administrator has changed it. Anyone who already has access to the underlying host operating system and knows this value can authenticate to the database as the superuser on any deployment where the default has not been rotated. The flaw is rated 8.6 under CVSS 4.0 (assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), requires local OS-level access rather than a network path, requires no user interaction or application-level authentication, and there is no public exploit identified at time of analysis; exploitation is fully prevented on systems where the superuser password has been reset.
Armatura One's backup and restore routine writes the complete database connection command - including the database superuser password in plaintext - into a log file stored on the host, so anyone able to read that log recovers credentials sufficient to take full control of the backend database. Exploitation is access-gated: it requires local access to the server operating system (CVSS vector AV:L/PR:L), the privilege to read the affected log, and a prior backup or restore operation to have actually populated the file with the credential, which makes the realistic risk post-compromise privilege escalation or insider abuse rather than remote attack. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue has been published through CISA's ICS advisory program (ICSA-26-274-01), indicating deployments in operational-technology and physical-security environments.
Cleartext credential disclosure in the Armatura One message broker causes client connection credentials and their associated passwords to be written to the broker's operational log in plain text during normal operation, so anyone who can read that log - or a backup or diagnostic/support bundle containing it - obtains a usable credential. The exposure is local rather than network-reachable: per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) an attacker must already have low-privileged read access to the host filesystem or to an exported log, backup, or support bundle, and there is no public exploit identified at time of analysis. Assignment of CWE-532 means the credential never needs to be decrypted or brute-forced; the weakness is simply that the protocol exchanges are logged verbatim, which is why this is rated a low-to-moderate priority issue whose practical blast radius depends on how widely logs and support bundles are copied and shared.