Armatura One: Hard-coded cryptographic key protects stored credentials
Summary
Armatura One stores database and message-broker credentials in an install configuration file, encrypted with AES-128-CBC when this protection is enabled. The key and initialization vector are fixed values embedded in the software and identical across all installations. An attacker with a copy of the installation package can recover them and decrypt the stored credentials of any installation whose encrypted configuration file they obtain.
Affected
- Armatura One before 4.7.2
- Armatura One (USA) before 4.6.1
- Only installations with the encryption protection enabled are affected by the hard-coded key.
Fixed in
- Armatura One V4.7.2 (standard line); users should upgrade from V4.7.1 or earlier
- Armatura One V4.6.1_USA (USA line); users should upgrade from V4.3.1_USA or earlier
Workaround
Unknown.
Exploitation
- CISA reports no known exploitation specifically targeting Armatura One in relation to these vulnerabilities.
- No public proof of concept was found for this CVE.
- Attack requires local or file access to an installation package and the encrypted configuration file.
- EPSS score: 0.00087 (very low).
Our recommendation
- Inventory all Armatura One servers and versions, including USA-line installations.
- Upgrade to V4.7.2 or V4.6.1_USA, working with Armatura technical support; confirm exact build numbers before rollout.
- Confirm the servers are not internet-facing and restrict broker and database ports to required management hosts.
- Check whether the encryption protection is enabled and restrict access to installation packages, configuration files and backups.
- Patch CVE-2023-46604 (embedded ActiveMQ, listed in CISA KEV) at the same time, as it is the more immediate threat.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-274-01 www.cisa.gov
- CISA CSAF document ICSA-26-274-01 github.com
- OpenCVE CVE-2026-94591 app.opencve.io
- Vulners Rapid7 CVE-2026-94591 vulners.com
- Burns & McDonnell advisory on Armatura One 1898advisories.burnsmcd.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:23.
Original description (NVD)
Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, and can then decrypt the stored credentials of any specific installation to which the attacker separately obtains the encrypted configuration file.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.