- Rockwell Automation fixed two flaws in its 1732E ArmorBlock I/O module. One lets an unauthenticated attacker change the web password; the other can knock the device offline.
- The module's built-in web page is a login door, and a power cycle is the only recovery from the second flaw.
- List which industrial devices run a web server, who can reach them, and who may power-cycle them mid-shift.
The settings page is the front door
Every website has a login page. So does a small module bolted to a factory machine. Rockwell Automation has just fixed two flaws in one such module. The lesson is that a plant's settings page deserves the same scrutiny as any public website.
Rockwell says it found the issues itself during routine testing. The product is the 1732E ArmorBlock I/O. It is a rugged input and output module that sits on the machine. It connects over EtherNet/IP and has a built-in web server for setup and management. Three models are listed: 1732E-IB16M12R, 1732E-OB16M12R and 1732E-16CFGM12R.
How the two flaws work
CVE-2026-12655 is the more serious flaw. An outsider with no valid login can set a new password on the module's web page. Rockwell says this could mean admin account takeover or unauthorized changes to the device's settings. SecurityWeek reports that the flaw is rated critical.
Rockwell files it under CWE-294, authentication bypass by capture-replay. In general terms, an attacker records a valid message and sends it again. The device then accepts it as genuine. The advisory does not describe the exact steps for this module.
CVE-2026-12656 is a denial-of-service flaw. The module copes badly with network storm traffic, which is a flood of messages. Rockwell files it under CWE-770, a weakness class for systems that set no ceiling on the work they accept.
During a storm, the module may lose contact with other equipment. It may also throw faults and have trouble on its open TCP and UDP ports. Those are the two standard channels devices use to send data. The device returns to normal only after a power cycle.
Customers who cannot move to a corrected version are told to follow Rockwell's security best practices. The advisory does not say whether anyone has exploited either flaw.
Why a power cycle is a business problem
A crashed website server can often be restarted from a laptop. Here, Rockwell says recovery needs a power cycle. That ties the fix to a physical device on a machine. Someone with authority to interrupt that machine has to act.
The password flaw carries a different cost. If an attacker changes the password, the real operator may be locked out of their own device. That is the practical meaning of the "account takeover" Rockwell describes.
Other advisories in the same batch
This is one advisory, so it proves no trend. But the same SecurityWeek roundup lists other flaws that touch credential and browser-facing flows.
Schneider Electric disclosed a flaw in Pro-face STW6000 and Harmony STW6 devices. According to SecurityWeek, an attacker could take control by tricking a user into visiting a malicious webpage.
ABB disclosed a dynovaPRO flaw that bypasses the credential reset flow. ABB told SecurityWeek it knows of no in-the-wild exploitation. It added that its internal log analysis found password change events that "may indicate testing or reconnaissance activity."
ABB did not treat the logs as proof of an attack. It treated them as a signal worth reporting. That is a useful habit for any plant.
The idea: inventory the doors, not just the machines
Plants usually track machines by function: what each makes, how fast, how often it fails. Security teams need a second list of which devices run a web server. Each one is a login page, whether or not anyone thinks of it as a website.
Siemens alone published 17 new advisories this cycle. It patched some issues and offered mitigations for others until permanent fixes arrive. Volume like that is why a plant cannot rely on memory to know what is exposed.
Questions for your operations and security teams
Do we own any 1732E ArmorBlock modules? Which models and firmware versions are running? Which of our devices run a built-in web server, and who can reach them over the network?
Who has authority to power-cycle a device mid-shift, and how fast could they do it? Does anyone watch for unexpected password changes on industrial devices, as ABB's log review did?
A plant is only as well defended as its least-watched login page. The small box on the machine has one too.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Rockwell Automation.
