CVE-2016-9334

moderate-risk
Published 2017-02-13

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD, Series A and B, Version 14.000 and prior versions. User credentials are sent to the web server in clear text, which may allow an attacker to discover the credentials if they are able to observe traffic between the web browser and the server.

Do I need to act?

-
0.07% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10 High
NETWORK / LOW complexity

Affected Products (20)

1763-L16Awa Series A
1763-L16Bbb Series A
1763-L16Bbb Series B
1766-L32Awaa Series A
1766-L32Bwa Series B
1766-L32Bwaa Series A
1766-L32Bwaa Series B
1766-L32Bxba Series A
1763-L16Awa Series B
1763-L16Bwa Series A
1763-L16Bwa Series B
1763-L16Dwd Series A
1763-L16Dwd Series B
1766-L32Awa Series A
1766-L32Awa Series B
1766-L32Awaa Series B
1766-L32Bwa Series A
1766-L32Bxb Series A
1766-L32Bxb Series B
1766-L32Bxba Series B

Affected Vendors

Rockwellautomation

References (4)

Third Party Advisory http://www.securityfocus.com/bid/95302
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06
Third Party Advisory http://www.securityfocus.com/bid/95302
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06
46
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 0/34 · Minimal
Exposure 20/34 · Moderate