CVE Vulnerabilities

CVE-2017-7903

Weak Password Requirements

Published: Jun 30, 2017 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. The affected products use a numeric password with a small maximum character size for the password.

Weakness

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Affected Software

Name Vendor Start Version End Version
1763-l16awa_series_a Rockwellautomation * 16.000 (including)
1763-l16awa_series_b Rockwellautomation * 16.000 (including)
1763-l16bbb_series_a Rockwellautomation * 16.000 (including)
1763-l16bbb_series_b Rockwellautomation * 16.000 (including)
1763-l16bwa_series_a Rockwellautomation * 16.000 (including)
1763-l16bwa_series_b Rockwellautomation * 16.000 (including)
1763-l16dwd_series_a Rockwellautomation * 16.000 (including)
1763-l16dwd_series_b Rockwellautomation * 16.000 (including)

Potential Mitigations

  • A product’s design should require adherance to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes:

  • Depending on the threat model, the password policy may include several additional attributes.

  • See NIST 800-63B [REF-1053] for further information on password requirements.

References