Attack Chain

1. An attacker identifies an internet-exposed Armatura One server with the Apache ActiveMQ OpenWire listener active.
2. The attacker sends a crafted malicious object through the OpenWire protocol to exploit the CVE-2023-46604 deserialization flaw.
3. The server deserializes the object, resulting in arbitrary code execution with the highest level of privilege.
4. The attacker accesses the host filesystem to locate installation configuration files containing encrypted credentials.
5. Utilizing the hard-coded AES-128-CBC key recovered from the application binary (CVE-2026-94591), the attacker decrypts the stored configuration data.
6. The attacker leverages the recovered database superuser password (CVE-2026-94592) or credentials exposed in plaintext logs (CVE-2026-94593) to gain direct database access.
7. The attacker modifies access-control lists or system settings to gain persistent control over the facility's physical security systems.

Impact

Successful exploitation allows unauthenticated attackers to achieve full host system compromise, including the execution of arbitrary code with administrative privileges. Impact includes unauthorized access to critical databases, loss of integrity in physical access control, and the potential for complete control over security systems in sensitive environments like critical manufacturing and energy sector facilities.

Recommendation

1. Upgrade Armatura One to version 4.7.2 or later, or Armatura One (USA) to version 4.6.1_USA or later, as specified in the vendor remediation guidance.
2. Perform a security review of all Armatura One deployments to ensure default credentials have been rotated and sensitive log files are restricted from unauthorized access.
3. Restrict network access to the Apache ActiveMQ OpenWire port (default port 61616) to trusted management subnets to mitigate CVE-2023-46604 if patching is delayed.
4. Hunt for unauthorized access to Armatura One configuration files and log directories on host systems.