Weak Password Hashing in Rockwell OTTO Fleet Manager Puts Industrial Credentials at Risk

The Vulnerability

CISA has disclosed a moderate-severity vulnerability (CVE-2026-75112, CVSS 6.8) in Rockwell Automation's OTTO Fleet Manager, used globally in critical manufacturing and transportation environments. The flaw involves weak bcrypt password hashing with an insufficient work factor, significantly reducing the computational effort needed for attackers to crack password hashes offline. If an attacker gains access to an unencrypted system backup—through ransomware, insider threat, or misconfigured storage—they can brute-force credentials far more quickly than industry best practices should allow.

Why SMBs Should Care

This advisory highlights a critical gap many organizations overlook: backup security. Even strong passwords become liabilities when hashed poorly and stored in backups that aren't properly encrypted or access-controlled. For SMBs managing industrial control systems or working with vendors who do, this is a reminder to audit not just production systems but also backup repositories, vendor access, and password policies. Implement MFA wherever possible to add a critical second layer of defense, and ensure backups are encrypted both at rest and in transit. If you're using Rockwell OTTO Fleet Manager, contact your vendor immediately for remediation guidance.

Read the full CISA advisory

Need help securing your infrastructure and backup environment? O-Cyrus specializes in practical security assessments and infrastructure hardening for SMBs. Contact our team or explore our security services to ensure your systems—and their backups—are properly protected.