High severity · published Feb 13, 2017
CVE-2016-9334
An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and…
7.3
CVSS
4.1%
EPSS
No
On KEV
Description
An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD, Series A and B, Version 14.000 and prior versions. User credentials are sent to the web server in clear text, which may allow an attacker to discover the credentials if they are able to observe traffic between the web browser and the server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1S
1763-l16awa Series A · Rockwellautomation
through 14.000 · source: NVD
1S
1763-l16awa Series B · Rockwellautomation
through 14.000 · source: NVD
1S
1763-l16bbb Series A · Rockwellautomation
through 14.000 · source: NVD
1S
1763-l16bbb Series B · Rockwellautomation
through 14.000 · source: NVD
1S
1763-l16bwa Series A · Rockwellautomation
through 14.000 · source: NVD
1S
1763-l16bwa Series B · Rockwellautomation
through 14.000 · source: NVD
1S
1763-l16dwd Series A · Rockwellautomation
through 14.000 · source: NVD
1S
1763-l16dwd Series B · Rockwellautomation
through 14.000 · source: NVD
1S
1766-l32awa Series A · Rockwellautomation
through 15.004 · source: NVD
1S
1766-l32awa Series B · Rockwellautomation
through 15.004 · source: NVD
1S
1766-l32awaa Series A · Rockwellautomation
through 15.004 · source: NVD
1S
1766-l32awaa Series B · Rockwellautomation
through 15.004 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9334
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9334
Third Party Advisory
http://www.securityfocus.com/bid/95302
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06
More from 1763-l16awa Series A
9.8
CVE-2017-7903
A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00…
9.8
CVE-2017-7902
A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B,…
9.8
CVE-2017-7899
An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and…
9.8
CVE-2017-7898
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA,…
9.8
CVE-2016-0868
Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via…