Rockwell 1732E ArmorBlock® - Multiple Vulnerabilities
Plan PatchCVSS 9.1SD1801Oct 13, 2026
Rockwell Automation
Summary
Multiple vulnerabilities exist in the Rockwell Automation 1732E ArmorBlock (all versions) that allow remote code execution without authentication. The device improperly validates network input, enabling an attacker to execute arbitrary code that could compromise encrypted communications and VPN functionality. No firmware patch is currently available.
What this means
What could happen
An attacker with network access to a 1732E ArmorBlock could execute arbitrary code on the device, potentially allowing them to intercept, modify, or disable encrypted communications between control systems and field devices, disrupting plant operations.
Who's at risk
This affects water utilities, electric utilities, and other critical infrastructure operators who use Rockwell Automation's 1732E ArmorBlock for encrypted communications and VPN termination between control networks and remote SCADA systems or field devices. Any organization relying on this device for secure industrial network traffic is at risk.
How it could be exploited
An attacker on the network could send specially crafted packets to the 1732E ArmorBlock's network interface. The device fails to properly validate input, allowing the attacker to trigger a code execution vulnerability. Once running code on the ArmorBlock, the attacker could tamper with VPN tunnels or encrypted traffic that the device is protecting.
Prerequisites
- Network access to the 1732E ArmorBlock
- No special credentials or authentication required
- Device must be connected to a network accessible from the attacker
remotely exploitableno authentication requiredno patch availablecritical CVSS score (9.1)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
1732E ArmorBlockAll versionsNo fix (EOL)
Remediation & Mitigation
0/4
Do now
0/3HARDENINGImplement network segmentation to isolate 1732E ArmorBlocks on a dedicated, restricted network segment with no direct access from untrusted networks
WORKAROUNDDeploy firewall rules to restrict inbound traffic to the 1732E ArmorBlock to only required sources and ports for legitimate VPN/encryption operations
HARDENINGMonitor network traffic to and from 1732E ArmorBlocks for anomalous activity, unusual packet sizes, or unauthorized connection attempts
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HARDENINGEscalate with Rockwell Automation to obtain guidance on extended support, workarounds, or timeline for a security update addressing these vulnerabilities
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/135b851c-2285-4470-a3af-e560a6ec8a91Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.