OTTO® Fleet Manager – Weak Password Hashing Configuration
The security of our products is important to us as your industrial automation supplier. This security issue was found internally during routine testing and is being reported based on our commitment to customer transparency and improvement of all business environments.
Product Description
OTTO® Fleet Manager is enterprise-scale fleet management software that acts as the system supervisor for a fleet of OTTO® autonomous mobile robots (AMRs), intelligently managing work assignments, charging, parking, and traffic so materials move efficiently with minimal human intervention.
Affected Products and Solution
Affected Product |
CVE |
Affected Software Version |
Corrected in Software Version |
Affected Part Numbers |
OTTO® Fleet Manager |
CVE-2026-75112 |
V2.36.2 and prior |
(See mitigation below on how to implement) |
029763 029764 030100 029766 029767
|
Security Issue Details for CVE-2026-75112
Category |
Details |
CVE ID |
CVE-2026-75112 |
Impact |
A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup, the weakly hashed credentials could be more easily compromised. |
CVSS 3.1 Base Score |
|
CVSS 4.0 Base Score |
|
CWE |
CWE-916: Use of Password Hash With Insufficient Computational Effort |
Known Exploited Vulnerability |
No |
Mitigations and Workarounds
Customers using the affected software, who are not able to upgrade to one of the corrected versions or apply the mitigations below should use our security best practices.
Instructions To Enable Encrypted System Backup
OTTO® Fleet Manager now supports encrypted System Backup as of version 2.36.3. Its use is configurable using a user-chosen passphrase. Support for the creation and restoration of unencrypted backups remains.
If configured, system backups will be encrypted with a passphrase that is set when running the cluster setup. That passphrase will be used to decrypt backups for restoration in OTTO® Fleet Manager. A prompt to enter the passphrase during the restore workflow will be displayed if the to-be-restored backup is encrypted.
See either the single or multi-VM cluster deployment instructions for details on changing the system backup encryption passphrase.
Initial installation: When running through the initial configuration of the OTTO® Fleet Manager cluster, entering a passphrase is required to encrypt the OTTO® Fleet Manager system backup. Confirm the configuration by entering the non-blank passphrase again.
Reconfiguration/upgrade: Changing the passphrase requires executing cluster setup again. When reconfiguring/upgrading, the following options will be displayed for system backup encryption:
If a passphrase was not previously set, the basic passphrase setup screen will be shown from initial installations.
If a passphrase was previously set, an option screen will be displayed with the following:
- Keep - Keep the existing passphrase (no change)
- Change – Set a new passphrase. Setting a new passphrase will require re-entry of the same passphrase to confirm the configuration.
- Clear – Remove passphrase and disable backup encryption.
Revision History
Revision |
Date |
Description |
1.0 |
8/19/2026 |
Initial release |
Glossary:
- Bcrypt: A password hashing algorithm designed to securely store passwords by incorporating a salt and an adaptive cost factor, making brute-force attacks computationally expensive.
- Password Hashing: The process of converting a plaintext password into a fixed-length, irreversible string using a cryptographic hash function, used to securely store and verify user credentials.
- Encryption: The process of converting data into an unreadable format using a cryptographic algorithm and key, ensuring that only authorized parties can access the original information.
Get Up-to-Date Product Security Information
Visit the Rockwell Automation security advisories on the Trust Center page to:
· Review the current list of Rockwell Automation security advisories
· Report a possible security issue in a Rockwell Automation product
· Learn more about the vulnerability policy
Support
If you have any questions regarding the security issue(s) above and how to mitigate them, contact our support here.
If you have any questions regarding this disclosure, please contact PSIRT
Email: rasecure@ra.rockwell.com
Legal Disclaimer
Rockwell Automation DOES NOT WARRANT THE COMPLETENESS, TIMELINESS OR ACCURACY OF ANY OF THE DATA CONTAINED IN THIS WEB SITE AND MAY MAKE CHANGES THERETO AT ANY TIME IN ITS SOLE DISCRETION WITHOUT NOTICE. FURTHER, ALL INFORMATION CONVEYED HEREBY IS PROVIDED TO USERS "AS IS." IN NO EVENT SHALL ROCKWELL BE LIABLE FOR ANY DAMAGES OF ANY KIND INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS PROFIT OR DAMAGE, EVEN IF Rockwell Automation HAVE BEEN ADVISED ON THE POSSIBILITY OF SUCH DAMAGES. Rockwell Automation DISCLAIMS ALL WARRANTIES WHETHER EXPRESSED OR IMPLIED IN RESPECT OF THE INFORMATION (INCLUDING SOFTWARE) PROVIDED HEREBY, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, AND NON-INFRINGEMENT. Note that certain jurisdictions do not countenance the exclusion of implied warranties; thus, this disclaimer may not apply to you.
