Low bcrypt work factor makes offline password cracking trivial
A low bcrypt work factor in Rockwell Automation’s OTTO Fleet Manager could let attackers crack passwords far more cheaply than expected.
What the advisory says
The CISA advisory identifies CVE‑2026‑75112 in OTTO Fleet Manager versions up to V2.36.2. The flaw lies in using a bcrypt hash with an insufficient computational effort, scoring a CVSS v3 base of 6.8. Exploitation does not require network access; an adversary must first obtain an unencrypted system backup that contains the password hashes.
Technical details
Because the work factor is set too low, the cost of an offline brute‑force attack drops dramatically. An attacker who already possesses the backup can run password‑guessing tools against the hashes in a fraction of the time a properly‑configured bcrypt would demand.
Who’s at risk
The product is deployed worldwide in critical manufacturing and transportation systems. Any organization that runs OTTO Fleet Manager ≤ V2.36.2 and stores unencrypted backups is exposed.
Defensive steps
- Upgrade to the latest OTTO Fleet Manager release where the bcrypt work factor has been hardened.
- If upgrading immediately is not possible, re‑hash existing passwords with a stronger work factor (e.g., bcrypt cost ≥ 12) and enforce password complexity.
- Encrypt all system backups and restrict backup access to trusted accounts only.
- Rotate passwords for all accounts that were stored in the vulnerable version.
- Monitor for any unusual access to backup files or credential‑related logs.
Why it matters
Even though no public exploitation has been reported, the ease of offline cracking could give a determined insider or a threat actor who compromises a backup a quick path to privileged access, potentially disrupting manufacturing lines or logistics operations.