Rockwell ArmorBlock 3.013 Fixes Authentication Bypass and DoS
Tech GuruQuick Answer
Rockwell published SD1801 for specified 1732E ArmorBlock I/O modules on 3.012 and earlier. Confirm each catalog number, move affected devices to 3.013, validate web management and I/O communications, and retain configuration and change evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory 1732E ArmorBlock catalog numbers and software versions, preserve configurations and network evidence, deploy 3.013 through the supported engineering process, and validate webserver credentials, EtherNet/IP I/O, TCP/UDP behavior, alarms, and recovery.
Last verified: 2026-10-15 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | specified 1732E ArmorBlock I/O catalog numbers |
|---|---|
| Advisory | SD1801 |
| CVEs | CVE-2026-12655, CVE-2026-12656 |
| Authoritative release date | 2026-10-13 12:35:00 UTC |
| Authority revision date | 2026-10-13 12:35:00 UTC |
| Affected versions | the SD1801-listed 1732E ArmorBlock I/O catalog numbers running software 3.012 and earlier; the CVE-specific catalog-number sets differ. |
| Fixed version | 1732E ArmorBlock I/O software 3.013 |
| CVSS base score | 7.5 / 9.1 (CVSS v3.1); 8.7 / 8.8 (CVSS v4.0) |
| CVSS severity | High |
| Exploitation status | Rockwell states neither CVE is a Known Exploited Vulnerability.; no exploitation claim is inferred. |
What Changed
Rockwell disclosed an unauthenticated webserver-password change that can enable administrative takeover and a network-storm denial of service that requires a power cycle for recovery.
What To Validate Now
- Inventory. Locate specified 1732E ArmorBlock I/O catalog numbers deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: the SD1801-listed 1732E ArmorBlock I/O catalog numbers running software 3.012 and earlier; the CVE-specific catalog-number sets differ. Do not infer applicability from product family or severity alone.
- Remediate. Apply 1732E ArmorBlock I/O software 3.013 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The two CVEs do not cover identical catalog-number sets. Treat power cycling as recovery from the denial of service, not remediation, and coordinate updates with process owners and safety procedures. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
