Critical severity · published Jun 30, 2017
CVE-2017-7899
An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and…
9.8
CVSS
4.7%
EPSS
No
On KEV
Description
An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. User credentials are sent to the web server using the HTTP GET method, which may result in the credentials being logged. This could make user credentials available for unauthorized retrieval.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1S
1763-l16awa Series A · Rockwellautomation
through 16.000 · source: NVD
1S
1763-l16awa Series B · Rockwellautomation
through 16.000 · source: NVD
1S
1763-l16bbb Series A · Rockwellautomation
through 16.000 · source: NVD
1S
1763-l16bbb Series B · Rockwellautomation
through 16.000 · source: NVD
1S
1763-l16bwa Series A · Rockwellautomation
through 16.000 · source: NVD
1S
1763-l16bwa Series B · Rockwellautomation
through 16.000 · source: NVD
1S
1763-l16dwd Series A · Rockwellautomation
through 16.000 · source: NVD
1S
1763-l16dwd Series B · Rockwellautomation
through 16.000 · source: NVD
1S
1766-l32awa Series A · Rockwellautomation
through 16.000 · source: NVD
1S
1766-l32awa Series B · Rockwellautomation
through 16.000 · source: NVD
1S
1766-l32awaa Series A · Rockwellautomation
through 16.000 · source: NVD
1S
1766-l32awaa Series B · Rockwellautomation
through 16.000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7899
www.securitytracker.com
http://www.securitytracker.com/id/1038546
Patch
https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04
More from 1763-l16awa Series A
9.8
CVE-2017-7903
A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00…
9.8
CVE-2017-7902
A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B,…
9.8
CVE-2017-7898
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA,…
9.8
CVE-2016-0868
Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via…
8.6
CVE-2017-7901
A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and…