An unauthenticated attacker can alter the webserver password on a 1732E ArmorBlock I/O device, allowing takeover of the administrator account and unauthorized configuration changes. This flaw is a classic example of improper authorization, as the device fails to enforce authentication before permitting password updates. The consequence is loss of administrative control and the ability to modify device behavior or exfiltrate data.

The vulnerability impacts Rockwell Automation 1732E ArmorBlock® I/O units running firmware versions older than 3.013. Devices with these firmware versions expose a web server that can be accessed over the local network or the internet if not properly secured.

The CVSS score of 8.8 classifies the flaw as high severity. While an EPSS score is not available, the absence of a KEV listing does not diminish the risk; the attack vector is likely remote network access through the web interface, and no authentication is required to execute the password change. An attacker with network reachability to the device can gain full administrative privileges, posing a significant threat to operational continuity and system integrity.