CVE-2026-94592 PUBLISHED

Armatura LLC Armatura One Use of Hard-coded Credentials

Assigner: icscert
Reserved: 21.09.2026 Published: 02.10.2026 Updated: 02.10.2026

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.6

Product Status

Vendor Armatura LLC
Product Armatura One
Versions Default: unaffected
  • affected from 0 to 4.7.2 (excl.)
  • Version 4.7.2 is unaffected
Vendor Armatura LLC
Product Armatura One (USA)
Versions Default: unaffected
  • affected from 0 to 4.6.1 (excl.)
  • Version 4.6.1_USA is unaffected

Solutions

Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2.

Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA.

Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade.

Credits

  • Andrew Capobianco of RewCon.co reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-798 CWE