Vulnerability in Rockwellautomation 1763-L16awa Series A
CVE-2017-7898
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. There are no penalties for repeatedly entering incorrect passwords.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.052 (92.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.052 · newest: 0.052 · change: 0.000
Affected products
- Rockwellautomation 1763-L16awa Series A
- Rockwellautomation 1763-L16awa Series B
- Rockwellautomation 1763-L16bbb Series A
- Rockwellautomation 1763-L16bbb Series B
- Rockwellautomation 1763-L16bwa Series A
- Rockwellautomation 1763-L16bwa Series B
- Rockwellautomation 1763-L16dwd Series A
- Rockwellautomation 1763-L16dwd Series B
- Rockwellautomation 1766-L32awaa Series A
- Rockwellautomation 1766-L32awaa Series B
Weakness classification (CWE)
References
- www.securitytracker.com/id/1038546 (vdb-entry)
- ics-cert.us-cert.gov/advisories/ICSA-17-115-04 (US Government Resource, Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-7898?
- CVE-2017-7898 is a critical-severity vulnerability in Rockwellautomation 1763-L16awa Series A, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 9.8/10. Published 2017-06-30.
- How severe is CVE-2017-7898?
- Critical severity. CVSS v3 base score is 9.8 out of 10.