#NØØT_Security_Alerts 🚨 #ALERT — ROCKWELL AUTOMATION: CRITICAL FLAW ALLOWS UNAUTHENTICATED INDUSTRIAL CONTROLLER ADMIN TAKEOVER October 13, 2026 DISCLOSED BY: Rockwell Automation Security PRODUCT: 1732E ArmorBlock I/O — Industrial EtherNet/IP Devices CVE: CVE-2026-12655 SEVERITY: CRITICAL — CVSS 3.1: 9.1 WEAKNESS: CWE-294 — Authentication Bypass by Capture-Replay AFFECTED VERSIONS: Firmware 3.012 and earlier. Affected 1732E ArmorBlock catalog numbers are identified in the official advisory. IMPACT: An unauthenticated attacker can change the device’s integrated webserver password without valid credentials. Successful exploitation could enable administrative account takeover and unauthorized modifications to industrial device configurations. EXPOSURE: Requires network reachability to the vulnerable device’s management interface. No existing administrator credentials are required. Potential operational consequences depend on the device’s configuration and industrial environment. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL AUTHENTICATION VULNERABILITY. No confirmed malicious in-the-wild exploitation or independently verified working public exploit established. Forensic triage: Review unexpected webserver password changes, suspicious management-interface connections and unauthorized device configuration modifications. Compare running configurations against approved engineering baselines. No verified CVE-specific attacker IOCs published. URGENT ACTION: Upgrade affected ArmorBlock devices to firmware 3.013. Restrict management interfaces to authorized engineering networks. Review industrial network segmentation and investigate unexplained configuration changes. Coordinate firmware deployment with operational personnel to avoid unintended production disruption. SOURCE: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1801.html CONFIDENCE: HIGH — Rockwell Automation’s October 13 security advisory confirms the authentication weakness, affected firmware and administrative takeover impact. ACTIVE EXPLOITATION: NOT VERIFIED. #CyberSecurity #ThreatIntel #RockwellAutomation #ICS #OTSecurity #IndustrialSecurity