Rockwell Automation said its own routine testing found two flaws in the 1732E ArmorBlock I/O, a rugged input/output module mounted on machines, with a built-in web page for setup. SecurityWeek called one flaw critical: a person with no login can reset the web page password. Rockwell said that could hand over the admin account or allow changed settings. SecurityWeek also reported 17 new Siemens advisories on Tuesday. The most severe cover certain S7-1500 controllers, Industrial Edge devices and a Ruggedcom access controller.
Rockwell calls the first flaw a capture-replay weakness: a recorded valid request is sent again and still accepted. The second is a denial-of-service flaw. Rockwell said a flood of network traffic can break communication and cause faults, and only a power cycle restores the device. The sources do not say anyone has used either flaw. Rockwell's advisory refers to corrected versions, but the text reviewed does not list them. Check advisory SD1801 for the version table.
A setup web page on a field device is a login gate, and here a stranger can reset it. Useful questions: where can that page be reached, are ArmorBlock units kept apart from other networks, and what does a power cycle cost on a running line?