Armatura LLC Armatura One (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592 +2 more)
Armatura One access-control system ships five vulnerabilities including a critical Apache ActiveMQ deserialization RCE already exploited in ransomware campaigns; upgrade to V4.7.2 or V4.6.1_USA immediately. Armatura One embeds Apache ActiveMQ vulnerable to CVE-2023-46604, enabling unauthenticated remote code execution with highest privilege. Four additional CVEs expose hard-coded crypto keys, fixed database superuser passwords, and plaintext credential logging, compounding post-compromise risk.
Detection / Hunteropenrouter
Immediate Actions
- Upgrade Armatura One to V4.7.2 or V4.6.1_USA immediately.
- Block all external access to OpenWire port 61616 at network perimeter.
- Change database superuser password from vendor default if not already changed.
- Restrict network exposure of Armatura One hosts to essential internal subnets only.
Key Takeaways
- CVE-2023-46604 is listed in CISA's KEV catalog and has been used in ransomware campaigns.
- Affected versions: Armatura One <4.7.2 and Armatura One (USA) <4.6.1.
- Fixes: upgrade to V4.7.2 (global) or V4.6.1_USA (USA release line).
- Hard-coded AES-128-CBC key and IV are identical across every installation.
- Database superuser receives a fixed vendor-defined password at creation time.
Attack Chain
- Initial Access: Unauthenticated attacker sends crafted OpenWire protocol message to embedded ActiveMQ listener (CVE-2023-46604)
- Execution: Deserialization of arbitrary object graph triggers code execution with highest OS privilege
- Credential Access: Attacker reads plaintext database superuser password from backup/restore logs (CVE-2026-94593)
- Credential Access: Attacker decrypts config file using hard-coded AES key and IV (CVE-2026-94591)
- Persistence: Attacker authenticates to database using fixed vendor superuser password (CVE-2026-94592)
- Impact: Attacker gains control of physical access-control system
Affected Systems
- Armatura One <4.7.2
- Armatura One (USA) <4.6.1
- Embedded Apache ActiveMQ OpenWire listener
- Communications sector ICS deployments
- Critical Manufacturing sector ICS deployments
- Energy and Transportation sector ICS deployments
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2023-46604 | Apache ActiveMQ (embedded in Armatura One) | Critical | Unauthenticated deserialization flaw in OpenWire marshaller allows arbitrary code execution with highest privilege. |
| CVE-2026-94591 | Armatura One configuration encryption | High | Hard-coded AES-128-CBC key and IV identical across all installations enable credential decryption. |
| CVE-2026-94592 | Armatura One database initialization | High | Fixed vendor-defined database superuser password assigned at creation time across all installations. |
| CVE-2026-94593 | Armatura One backup and restore routine | High | Full database connection command with superuser password logged in plaintext on host. |
| CVE-2026-94594 | Armatura One message broker logging | Medium | Message broker logs client connection credentials and password in plaintext during normal operation. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | RCE via deserialization produces process activity, but ICS hosts may lack EDR agents. |
| Network Visibility | High | OpenWire protocol traffic to embedded ActiveMQ listener is detectable on network segments. |
| Detection Difficulty | Moderate | CVE-2023-46604 exploitation has known signatures; credential logging flaws require file access monitoring. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Inbound connections to OpenWire port 61616 from non-internal hosts indicate exploitation of CVE-2023-46604 (T1190). | Network flow logs, firewall logs | Initial Access | Low — external access to ActiveMQ is abnormal. |
| Database superuser logins from unexpected processes or times indicate use of hard-coded credentials (T1078). | Database authentication logs | Persistence | Medium — legitimate admin sessions may match. |
| Read access to backup logs or message broker logs by non-admin accounts indicates credential harvesting from plaintext logs (T1552.004). | File access audit logs | Credential Access | Medium — backup operators may read logs legitimately. |
Required Log Sources
- Network flow logs (OpenWire port 61616)
- Process creation logs on Armatura host
- Database authentication logs
- File access logs for config and log files
- Backup and restore operation logs
Key Behavioral Indicators
- Inbound TCP connections to port 61616 from external sources
- Unexpected child processes spawned by ActiveMQ Java process
- Database superuser authentication from non-application service accounts
- File reads of backup logs by non-admin users
- Config file access outside of installation or upgrade windows
Control Gaps
- Network segmentation allowing external access to ActiveMQ OpenWire listener
- Lack of unique credential generation per installation
- Plaintext credential logging without redaction
- No EDR coverage on ICS host operating systems
False Positive Assessment
Low — Exploitation of CVE-2023-46604 produces distinctive OpenWire protocol anomalies and unexpected process spawning; credential access via logs requires file-read monitoring but patterns are specific.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Isolate Armatura One systems behind firewalls separate from business networks.
- Use VPN for any required remote access to control system networks.
- Rotate any credentials previously stored in backup logs or support bundles.
- Disable or restrict ActiveMQ OpenWire listener if not required for operation.
User Protection
- Monitor for and purge plaintext credentials from existing log files and backups.
- Apply principle of least privilege to log file access on Armatura hosts.
- Audit database superuser account usage for signs of unauthorized access.
MITRE ATT&CK Mapping
Initial Access
Execution
Credential Access
Plain-Language Summary
A physical access-control system called Armatura One has multiple security flaws. The most serious one lets an attacker remotely run code on the server without a password by exploiting a known vulnerability in a bundled component. Other flaws include fixed passwords and encryption keys shared across all installations, plus credentials written to log files in plain text. Organizations using Armatura One should upgrade to the latest patched version immediately and restrict network access to the system.
- cveCVE-2023-46604Unauthenticated deserialization flaw in OpenWire marshaller allows arbitrary code execution with highest privilege.
- cveCVE-2026-94591Hard-coded AES-128-CBC key and IV identical across all installations enable credential decryption.
- cveCVE-2026-94592Fixed vendor-defined database superuser password assigned at creation time across all installations.
- cveCVE-2026-94593Full database connection command with superuser password logged in plaintext on host.
- cveCVE-2026-94594Message broker logs client connection credentials and password in plaintext during normal operation.