CVE-2026-12655: CWE-294: Authentication Bypass by Capture-replay in Rockwell Automation 1732E ArmorBlock® I/O
Description
CVE-2026-12655 is a high-severity authentication bypass vulnerability in Rockwell Automation 1732E ArmorBlock® I/O devices. An unauthenticated attacker can change the device's webserver password without valid credentials, potentially leading to admin account takeover or unauthorized configuration changes. The affected versions are from 0 up to and including 3.012. No patch information is provided, and no known exploits are reported in the wild.
CVSS v4.0
Score 8.8high
Affected software
Rockwell Automation
1732E ArmorBlock® I/O
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-12655) in Rockwell Automation 1732E ArmorBlock® I/O allows an unauthenticated attacker to bypass authentication controls and change the device's webserver password. This is classified under CWE-294 (Authentication Bypass). The vulnerability affects versions >=0 and <=3.012. The CVSS 4.0 base score is 8.8, indicating high severity, with network attack vector, no privileges or user interaction required, and high impact on integrity and availability.
Potential Impact
Successful exploitation enables an attacker without any credentials to take over the administrator account by changing the webserver password. This could lead to unauthorized modification of device configuration, potentially disrupting device operation or compromising system integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided, organizations should monitor Rockwell Automation advisories for updates and consider restricting network access to the affected devices to trusted sources until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Rockwell
- Date Reserved
- 2026-06-18T18:48:53.410Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace415b2cdf04f656747da8
Added to database: 10/13/2026, 14:34:03 UTC
Last enriched: 10/13/2026, 14:50:15 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.