Two flaws, one corrected release
Rockwell Automation published advisory SD1801 on October 13 covering two vulnerabilities in specified 1732E ArmorBlock I/O modules. The vendor lists version 3.012 and earlier as affected and 3.013 as corrected. CVE-2026-12655 could let an unauthenticated attacker change the embedded webserver password, potentially enabling account takeover or configuration changes. CVE-2026-12656 concerns network traffic that can interrupt communications or fault a device, with a power cycle required for recovery. The affected catalog-number lists differ between the two vulnerabilities.
Match the installed equipment to the advisory
Rockwell says it discovered the issues during internal testing and marks them as not known exploited in the advisory. The publication of a fix is therefore not evidence of a reported attack on a factory or utility. Operators should consult the exact model lists before assigning work. A product-family name alone is insufficient to decide which devices require the same maintenance action.
Plan around the physical process
Our analysis is that manufacturers should connect each affected device to the line, machine and maintenance team that depends on it. An inventory that shows only an IP address and software version may leave the scheduler unable to judge an appropriate service window. Add the operational owner and the approved recovery procedure before moving from assessment to change. Where an energy operator uses the listed equipment, the same principle applies: personnel responsible for the process must participate in evaluating and supervising the work. The advisory does not justify experimenting on production equipment to see whether a fault can be reproduced.
Close the work with evidence
An industrial service provider can make the handoff useful by recording the catalog number, observed version, planned action and confirmation after maintenance. If work is deferred, document the reason, the person accepting responsibility and the next review point. Network access to the management interface also deserves a review with the plant team, without assuming an office-network control can be copied unchanged into an operational environment. These are suggested maintenance practices, not vendor-specific installation instructions. The finished record should allow a different engineer to understand what was changed and what remains outstanding. That is the practical test of whether an advisory has become completed risk-reduction work rather than another item marked acknowledged in a queue.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
