Rockwell Automation SD1801: 1732E ArmorBlock I/O firmware 3.012 and earlier — CVE-2026-12655 (CVSS 4.0 8.8) lets an unauthenticated attacker change the web server password and take over admin; CVE-2026-12656 network-storm DoS
Rockwell Automation published security advisory SD1801 on 13 October 2026 for the 1732E ArmorBlock I/O, an on-machine EtherNet/IP distributed I/O module with a built-in configuration web server. CVE-2026-12655 (CWE-294, authentication bypass by capture-replay) lets an unauthenticated attacker change the device's web server password without valid credentials, which can mean admin account takeover or unauthorised configuration changes. CVE-2026-12656 is a denial-of-service issue: network storm traffic can interrupt communication, fault the device and affect open TCP and UDP ports, and a power cycle is needed to recover. Rockwell lists both as corrected with no workaround and not on the CISA KEV list; the advisory's overall severity is High, while SecurityWeek's ICS Patch Tuesday round-up (14 Oct) describes the password flaw as critical. No exploitation is reported.
- Product
- Rockwell Automation 1732E ArmorBlock I/O
- Versions
- Firmware 3.012 and earlier affected; fixed in 3.013
- CVSS
- (CVSS 4.0) CVE-2026-12655; CVE-2026-12656 availability-only (VA:H)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Exploited in Australia?
- unknown
- Patch to
- Upgrade 1732E ArmorBlock I/O firmware to 3.013 or later (no workaround). Keep the module's web server and EtherNet/IP off the internet and reachable only from the control network or an engineering jump host, and reset the admin password after upgrading.
Primary: Rockwell Automation — SD1801 1732E ArmorBlock Multiple Vulnerabilities (13 Oct 2026) · Vendor: CVE record CVE-2026-12655 (CNA Rockwell; affected 3.012, fixed 3.013) · CVE: CVE-2026-12655, CVE-2026-12656 · SecurityWeek — ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw (14 Oct 2026)