Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Rockwell Allen‑Bradley PLCs may log user passwords

CVE-2017-7899 · published 9 years ago
Summary

Several models of Rockwell Automation Allen‑Bradley MicroLogix 1100 and 1400 controllers send login credentials in a web request that can be recorded in server logs. This could allow someone who gains access to those logs to see user passwords. Update the firmware to a version newer than 16.00 or change the system to use a secure login method that does not expose credentials.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
rockwellautomation 1763-l16awa_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16awa_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1763-l16awa_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16awa_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1763-l16bbb_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16bbb_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1763-l16bbb_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16bbb_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1763-l16bwa_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16bwa_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1763-l16bwa_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16bwa_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1763-l16dwd_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16dwd_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1763-l16dwd_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1763-l16dwd_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32awa_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32awa_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32awa_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32awa_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32awaa_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32awaa_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32awaa_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32awaa_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bwa_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bwa_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bwa_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bwa_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bwaa_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bwaa_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bwaa_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bwaa_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bxb_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bxb_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bxb_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bxb_series_b:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bxba_series_a <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bxba_series_a:*:*:*:*:*:*:*:*
rockwellautomation 1766-l32bxba_series_b <= 16.000
cpe:2.3:a:rockwellautomation:1766-l32bxba_series_b:*:*:*:*:*:*:*:*
Original advisory text
An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-...
An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. User credentials are sent to the web server using the HTTP GET method, which may result in the credentials being logged. This could make user credentials available for unauthorized retrieval.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published30 Jun 2017
Updated24 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-7899 · NVD
Track software like this
Free during beta