An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD, Series A and B, Version 14.000 and prior versions. Because of an Incorrect Permission Assignment for Critical Resource, users with administrator privileges may be able to remove all administrative users requiring a factory reset to restore ancillary web server function. Exploitation of this vulnerability will still allow the affected device to function in its capacity as a controller.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 2.7 | LOW | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L |
| Primary | 2.0 | 4.0 | MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
| CWE ID | Type | Source |
|---|---|---|
| NVD-CWE-Other | Primary | nvd@nist.gov |
| Hyperlink | Source | Resource |
|---|---|---|
| http://www.securityfocus.com/bid/95302 | ics-cert@hq.dhs.gov | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06 | ics-cert@hq.dhs.gov | Third Party Advisory US Government Resource |
| http://www.securityfocus.com/bid/95302 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory US Government Resource |