Rockwell 1732E ArmorBlock I/O: Authentication bypass allows webserver password change
Summary
Rockwell 1732E ArmorBlock I/O distributed I/O modules allow an unauthenticated attacker on the network to change the webserver password without valid credentials. Successful exploitation can lead to takeover of the admin account and unauthorized changes to the device configuration. Access to the device network is required, and the vulnerability is classified as CWE-294 (capture-replay authentication bypass).
Affected
- Rockwell Automation 1732E ArmorBlock I/O, firmware 3.012 and earlier
- Models: 1732E-IB16M12R, 1732E-OB16M12R, 1732E-16CFGM12R, 1732E-IB16M12DR, 1732E-OB16M12DR
Fixed in
- Firmware 3.013 or later
Workaround
- No workaround documented by the vendor (advisory states Workaround: No).
- Interim measure: restrict access to the webserver and EtherNet/IP ports to named engineering and management hosts, and keep the module off internet-reachable segments.
Exploitation
- Not listed as known exploited by Rockwell; CISA SSVC assessment: Exploitation none, Automatable yes.
- No public exploit or proof of concept found; CISA KEV status not verified directly.
Our recommendation
- Inventory 1732E modules and their firmware versions; identify devices at 3.012 or earlier.
- Plan the update to firmware 3.013 in the next maintenance window, following Rockwell's update guidance.
- Until patched, isolate the devices from IT and flat plant networks and limit webserver access to named hosts.
- Check device configuration and login or password-change records for unexpected changes.
- Re-check the Rockwell SD1801 advisory and CISA KEV for updates.
- Confirm the firmware list on the SD1801 page before rollout, as the research was based on partial advisory text.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rockwell Automation Security Advisory SD1801 www.rockwellautomation.com
- Rockwell Automation Security Advisories index www.rockwellautomation.com
- PSIRT CVE-2026-12655 psirt.com
- Vulners CVE-2026-12655 vulners.com
- HOL Guard CVE-2026-12655 hol.org
- CyberInsider: Rockwell patches ArmorBlock vulnerabilities cyberinsider.co.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:08.
Original description (NVD)
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.