VulnHub

Real-time Cybersecurity News

Critical

Armatura LLC Armatura One

All CISA Advisories
RansomwarePhishingCVECriticalApache

Overview

Armatura LLC's Armatura One software has several critical vulnerabilities that could allow attackers to gain unauthorized access to sensitive systems. Versions prior to 4.7.2 and 4.6.1 for the USA release are affected by issues including the ability to execute arbitrary code and access hard-coded credentials. Specifically, a deserialization flaw in the software's embedded Apache ActiveMQ component is a major concern, as it can allow unauthenticated attackers to execute code with high privileges. Additionally, hard-coded cryptographic keys and passwords could lead to further exploitation if attackers gain access to the installation package. Users are strongly advised to upgrade to the latest versions to mitigate these risks.

Key Takeaways

  • Affected Systems: Armatura One <4.7.2, Armatura One (USA) <4.6.1, affected by CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594
  • Action Required: Users should upgrade to Armatura One V4.
  • Timeline: Disclosed on October 2023

Original Article Summary

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. The following versions of Armatura LLC Armatura One are affected: Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) Armatura One (USA) <4.6.1 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) CVSS Vendor Equipment Vulnerabilities v3 9.8 Armatura LLC Armatura LLC Armatura One Deserialization of Untrusted Data, Use of Hard-coded Cryptographic Key, Use of Hard-coded Credentials, Insertion of Sensitive Information into Log File Background Critical Infrastructure Sectors: Communications, Critical Manufacturing, Energy, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2023-46604 Armatura One embeds Apache ActiveMQ, exposing its OpenWire protocol listener on the network by default. This embedded version is affected by CVE-2023-46604, a deserialization flaw in the OpenWire marshaller that allows an unauthenticated network attacker to trigger deserialization of an arbitrary object graph before authentication is checked. This can result in arbitrary code execution with the highest level of privilege on the host operating system. View CVE Details Affected Products Armatura LLC Armatura One Vendor: Armatura LLC Product Version: Armatura LLC Armatura One: <4.7.2, Armatura LLC Armatura One (USA): <4.6.1 Product Status: known_affected Remediations Vendor fix Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2. Vendor fix Armatura LLC Armatura One (USA) vers:all/<4.6.1: Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA. Vendor fix Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade. Mitigation For more information see the associated CISA security advisory ICSA-26-274-01 JSON. https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-274-01.json Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-94591 Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, and can then decrypt the stored credentials of any specific installation to which the attacker separately obtains the encrypted configuration file. View CVE Details Affected Products Armatura LLC Armatura One Vendor: Armatura LLC Product Version: Armatura LLC Armatura One: <4.7.2, Armatura LLC Armatura One (USA): <4.6.1 Product Status: known_affected Remediations Vendor fix Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2. Vendor fix Armatura LLC Armatura One (USA) vers:all/<4.6.1: Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA. Vendor fix Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade. Mitigation For more information see the associated CISA security advisory ICSA-26-274-01 JSON. https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-274-01.json Relevant CWE: CWE-321 Use of Hard-coded Cryptographic Key Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.4 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 8.6 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-94592 Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed. View CVE Details Affected Products Armatura LLC Armatura One Vendor: Armatura LLC Product Version: Armatura LLC Armatura One: <4.7.2, Armatura LLC Armatura One (USA): <4.6.1 Product Status: known_affected Remediations Vendor fix Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2. Vendor fix Armatura LLC Armatura One (USA) vers:all/<4.6.1: Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA. Vendor fix Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade. Mitigation For more information see the associated CISA security advisory ICSA-26-274-01 JSON. https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-274-01.json Relevant CWE: CWE-798 Use of Hard-coded Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.4 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 8.6 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-94593 Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available. View CVE Details Affected Products Armatura LLC Armatura One Vendor: Armatura LLC Product Version: Armatura LLC Armatura One: <4.7.2, Armatura LLC Armatura One (USA): <4.6.1 Product Status: known_affected Remediations Vendor fix Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2. Vendor fix Armatura LLC Armatura One (USA) vers:all/<4.6.1: Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA. Vendor fix Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade. Mitigation For more information see the associated CISA security advisory ICSA-26-274-01 JSON. https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-274-01.json Relevant CWE: CWE-532 Insertion of Sensitive Information into Log File Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.5 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-94594 Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential. View CVE Details Affected Products Armatura LLC Armatura One Vendor: Armatura LLC Product Version: Armatura LLC Armatura One: <4.7.2, Armatura LLC Armatura One (USA): <4.6.1 Product Status: known_affected Remediations Vendor fix Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2. Vendor fix Armatura LLC Armatura One (USA) vers:all/<4.6.1: Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA. Vendor fix Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade. Mitigation For more information see the associated CISA security advisory ICSA-26-274-01 JSON. https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-274-01.json Relevant CWE: CWE-532 Insertion of Sensitive Information into Log File Metrics CVSS Version Base Score Base Severity Vector String 3.1 4 MEDIUM CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.0 5.1 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Acknowledgments Andrew Capobianco of RewCon.co reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. CISA is not aware of exploitation specifically targeting Armatura One in relation to these vulnerabilities. CVE-2023-46604 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been used in ransomware campaigns against other Apache ActiveMQ deployments. Revision History Initial Release Date: 2026-10-01 Date Revision Summary 2026-10-01 1 Initial Publication Legal Notice and Terms of Use

Impact

Armatura One <4.7.2, Armatura One (USA) <4.6.1, affected by CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on October 2023

Remediation

Users should upgrade to Armatura One V4.7.2 or V4.6.1_USA to resolve these vulnerabilities. Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Ransomware, Phishing, CVE, and 2 more.

Read Original Article

Related Coverage

Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat

darkreading

A vulnerability has been discovered in the preview pane of Claude Code Desktop, which could allow attackers to steal sensitive credentials from developers without any interaction required. This zero-click flaw poses a significant risk as it can extract SSH private keys, AWS credentials, and Claude OAuth tokens quietly. Developers using this software may unknowingly expose their credentials, leading to potential unauthorized access to their systems and services. This incident raises concerns about the security of development tools and the need for heightened vigilance among users. It's crucial for developers to stay informed about this vulnerability and take necessary precautions to protect their sensitive information.

Oct 14, 2026

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

BleepingComputer

The U.S. Department of Justice has taken significant action against the Famous Chollima group, which is linked to North Korean IT workers allegedly engaged in remote schemes. Two individuals were arrested, and 14 others have been charged, with authorities seizing nearly 187 laptops that were reportedly used in these operations. This crackdown is part of broader efforts to combat North Korean cyber activities that threaten U.S. interests and the global cybersecurity landscape. The operation underscores the ongoing challenges posed by state-sponsored cyber activities and the need for vigilance in monitoring such threats. The arrests and seizures may disrupt the group's operations and deter similar activities in the future.

Oct 14, 2026

Ledger asks sellers across Asia to halt sales after supply-chain attack

BleepingComputer

Ledger, a well-known cryptocurrency wallet manufacturer, has initiated a halt on sales of its devices across several Asian countries, including Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. This decision comes amid concerns about potential tampering with the devices in the supply chain. Ledger has reached out to resellers and distributors, urging them to remove affected products from their shelves while the company conducts a thorough investigation. This situation raises significant concerns for users who rely on these wallets for secure cryptocurrency storage, as compromised devices could lead to unauthorized access to their funds. The company’s proactive approach aims to ensure the integrity of its products and protect its customers from possible security risks.

Oct 14, 2026

Cisco patches new Secure Email Gateway zero-day exploited in attacks

BleepingComputer

Cisco has issued a critical patch for a zero-day vulnerability in its Secure Email Gateway (SEG) that has been actively exploited by attackers. This flaw allows remote, unauthenticated users to execute commands with root privileges, posing a significant risk to organizations using the affected software. The vulnerability is particularly concerning as it can lead to unauthorized access and control over email systems, potentially compromising sensitive data. Users of Cisco's SEG are urged to apply the available patches immediately to safeguard their systems against these attacks. The situation emphasizes the need for timely updates and vigilance in protecting email infrastructures from evolving threats.

Oct 14, 2026

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

The Hacker News

The U.S. Department of Justice has charged 14 individuals and seized around 187 computers in a crackdown on a North Korean scheme that involved fraudulent remote IT workers. This operation targeted a conspiracy that impacted over 70 U.S. companies, with the accused facing charges related to wire fraud. The defendants include both U.S. citizens and Chinese nationals, highlighting the international dimension of the fraud. By disrupting this scheme, the U.S. aims to prevent North Korea from generating revenue through illegal means, which could potentially support its nuclear weapons program. This case underscores the ongoing challenges posed by state-sponsored cybercrime and the importance of international cooperation in addressing such threats.

Oct 14, 2026

ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

SecurityWeek

Siemens released 17 advisories addressing various vulnerabilities in its industrial control systems (ICS) this month. Notably, Rockwell Automation responded by fixing a serious flaw that could allow attackers to take control of its ArmorBlock devices. Additionally, ABB issued a warning concerning a potential probing of a vulnerability in its dynovaPRO product, indicating that attackers may be scanning for weaknesses. These updates are crucial as they aim to protect critical infrastructure from potential exploitation, underscoring the ongoing need for vigilance in the ICS sector.

Oct 14, 2026