Armatura LLC Armatura One: 5 CVEs, Critical 9.8
Summary
CISA reports 5 vulnerabilities in Armatura LLC Armatura One, Armatura One (USA). Weakness types: Deserialization of Untrusted Data, Use of Hard-coded Cryptographic Key, Use of Hard-coded Credentials (+1 more). Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network. At least one CVE is on CISA's Known Exploited Vulnerabilities list.
At a glance
- Vendor
- Armatura LLC
- Products
- Armatura One, Armatura One (USA)
- CVEs
- CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- Yes
- Sectors (per CISA)
- Communications, Critical Manufacturing, Energy, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2023-46604 | Deserialization of Untrusted Data | 9.8 | – | Yes (added 2023-11-02) | Armatura One embeds Apache ActiveMQ, exposing its OpenWire protocol listener on the network by default. This embedded version is affected by CVE-2023-46604, a deserialization flaw in the OpenWire marshaller that allows an unauthenticated network attacker to trigger deserialization of an arbitrary object graph before authentication is checked. This can result in arbitrary code execution with the hi… |
| CVE-2026-94591 | Use of Hard-coded Cryptographic Key | 8.4 | – | No | Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, a… |
| CVE-2026-94592 | Use of Hard-coded Credentials | 8.4 | – | No | Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed. |
| CVE-2026-94593 | Insertion of Sensitive Information into Log File | 7.8 | – | No | Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available. |
| CVE-2026-94594 | Insertion of Sensitive Information into Log File | 4.0 | – | No | Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential. |
Affected products (2)
- Armatura LLC Armatura One: <4.7.2
- Armatura LLC Armatura One (USA): <4.6.1
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2.
- Vendor Fix: Armatura LLC Armatura One (USA) vers:all/<4.6.1: Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA.
- Vendor Fix: Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade.
- Mitigation: For more information see the associated CISA security advisory ICSA-26-274-01 JSON. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.