As reported by CISA in advisory ICSA-26-239-03, Rockwell Automation has disclosed a password hashing weakness in its OTTO Fleet Manager product — a vulnerability that underscores a recurring and entirely avoidable class of failure in operational technology (OT) software: cryptographic misconfiguration baked into shipping code.
The flaw, tracked as CVE-2026-75112 with a CVSS v3 score of 6.8 (Medium), stems from an insufficient bcrypt work factor. In practical terms, this means the cost function governing how much computational effort is required to derive each hash was set too low — dramatically reducing the time and resources an attacker would need to crack stored credential hashes offline. This is not a remote code execution flaw, and it won't grant initial access on its own. But it materially weakens the last line of defense: if an attacker obtains a system backup through a separate intrusion, insider access, or a misconfigured storage exposure, those password hashes become far cheaper to reverse than they should be.
Why This Matters More Than the CVSS Suggests
A 6.8 Medium rating may understate the real-world risk in OT environments. OTTO Fleet Manager is deployed in critical manufacturing and transportation systems — sectors where credential compromise can facilitate lateral movement into production networks, manipulation of fleet logistics data, or disruption of safety-critical operations. The attack chain is straightforward: obtain a backup (which the advisory notes may be unencrypted by default), extract the hash store, and brute-force credentials on commodity hardware at a rate the original developers did not anticipate.
The deeper issue is that bcrypt work factor selection is a well-documented engineering decision. NIST SP 800-63B and OWASP's password storage cheat sheet both provide clear guidance: the work factor should be tuned so that hashing takes roughly 250 milliseconds on target hardware, and should be revisited as hardware capabilities improve. A work factor that was acceptable when the code was written may become inadequate years later — but shipping products rarely receive cryptographic parameter updates.
| CVE | CVSS | Affected Product | Affected Versions | Patched Version | Active Exploitation |
|---|---|---|---|---|---|
| CVE-2026-75112 | 6.8 (Medium) | Rockwell Automation OTTO Fleet Manager | <= V2.36.2 | V2.36.3 | Not reported |
Who Is Most at Risk
- Transportation and logistics operators running OTTO Fleet Manager for autonomous vehicle fleet coordination — credential compromise here could enable tampering with fleet routing or operational data.
- Critical manufacturing facilities where OTTO is integrated into broader OT networks — stolen credentials may serve as a pivot point into ICS environments.
- Any deployment where system backups are stored unencrypted, which the advisory explicitly flags as the prerequisite condition for exploitation.
The vulnerability is not the bcrypt algorithm itself — bcrypt remains sound. The problem is an inadequate cost parameter that fails to keep pace with modern GPU-based cracking capabilities, where consumer-grade hardware can now compute billions of hashes per second against weakly configured implementations.
Shield53 Recommendations
Immediate Actions
Hardening and Detection
- Enforce strong password policies — minimum 14 characters, no dictionary patterns. Strong passwords remain resistant to brute-force even with a low work factor, buying time until patching is complete.
- Deploy file integrity monitoring on backup directories and database files containing credential hashes. Alert on any unauthorized read or copy operations.
- Network-segment OTTO Fleet Manager from general corporate networks. If credentials are compromised, segmentation limits the blast radius and slows lateral movement.
- Review all Rockwell products in your environment for similar cryptographic parameter issues. This class of vulnerability is unlikely to be isolated to a single product line — initiate a vendor security review request for any Rockwell software handling authentication.
For organizations unable to patch immediately, the combination of encrypted backups, aggressive password policies, and access monitoring provides meaningful interim risk reduction — but none of these substitute for the upgrade. The patch corrects the root cause; everything else is compensating control.
