Armatura LLC Armatura One
Act NowCVSS 9.8ICS-CERT ICSA-26-274-01Oct 1, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Armatura One contains multiple critical vulnerabilities (CWE-502 insecure deserialization, CWE-321 hardcoded cryptographic key, CWE-798 hardcoded credentials, CWE-532 sensitive log exposure) that allow unauthenticated remote attackers to gain unauthorized database access, execute arbitrary code with root-level privileges, and assume complete control of the physical access-control system. Versions affected: Armatura One prior to 4.7.2 and Armatura One (USA) prior to 4.6.1.
What this means
What could happen
An attacker could gain complete control of the physical access-control system, including unauthorized database access and arbitrary code execution with full system privileges, potentially locking or unlocking buildings at will and compromising all access records.
Who's at risk
Organizations operating physical access-control systems powered by Armatura One, including security managers at facilities with badge readers, door locks, and entry gates. This affects any building with Armatura-managed access control including offices, data centers, utilities, and critical infrastructure facilities.
How it could be exploited
An attacker on the network can send a crafted request to the Armatura One system without credentials (CWE-502, CWE-798). The system improperly deserializes untrusted data and fails to validate API keys, allowing remote code execution with root-level privileges. The attacker can then manipulate access rules, disable logging, or lock/unlock doors remotely.
Prerequisites
- Network access to the Armatura One web interface or API (typically port 443)
- No authentication required to trigger the vulnerability
remotely exploitableno authentication requiredlow complexityactively exploited (KEV)high EPSS score (99.9%)affects safety systems
Exploitability
Actively exploited — confirmed by CISA KEV
Metasploit module available — weaponized exploitView module ↗
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Armatura One<4.7.2Fix available
Armatura One (USA)<4.6.1Fix available
Remediation & Mitigation
0/3
Do now
0/3Armatura One
HOTFIXUpgrade Armatura One to version 4.7.2 or later (or 4.6.1_USA for USA release line)
WORKAROUNDRestrict network access to the Armatura One system to authorized administrative networks only using firewall rules
HARDENINGMonitor Armatura One system logs for signs of unauthorized access or code execution attempts while updates are pending
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/717d2a5f-5995-41ce-be2b-43a51cf7ee97Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.