CVEvulnerability

CVE-2017-7902

9.8 CRITICAL Published 2017-06-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-06-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-323, CWE-330

Description

A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. The affected product reuses nonces, which may allow an attacker to capture and replay a valid request until the nonce is changed.

Affected configurations

• rockwellautomation 1763-l16awa series a (<= 16.000) • rockwellautomation 1763-l16awa series b (<= 16.000) • rockwellautomation 1763-l16bbb series a (<= 16.000) • rockwellautomation 1763-l16bbb series b (<= 16.000) • rockwellautomation 1763-l16bwa series a (<= 16.000) • rockwellautomation 1763-l16bwa series b (<= 16.000) • rockwellautomation 1763-l16dwd series a (<= 16.000) • rockwellautomation 1763-l16dwd series b (<= 16.000) • rockwellautomation 1766-l32awa series a (<= 16.000) • rockwellautomation 1766-l32awa series b (<= 16.000) • rockwellautomation 1766-l32awaa series a (<= 16.000) • rockwellautomation 1766-l32awaa series b (<= 16.000) • rockwellautomation 1766-l32bwa series a (<= 16.000) • rockwellautomation 1766-l32bwa series b (<= 16.000) • rockwellautomation 1766-l32bwaa series a (<= 16.000) • rockwellautomation 1766-l32bwaa series b (<= 16.000) • rockwellautomation 1766-l32bxb series a (<= 16.000) • rockwellautomation 1766-l32bxb series b (<= 16.000) • rockwellautomation 1766-l32bxba series a (<= 16.000) • rockwellautomation 1766-l32bxba series b (<= 16.000)

Related

Weakness · CWE (2)

  • CWE-323 Reusing a Nonce, Key Pair in Encryption weakness
  • CWE-330 Use of Insufficiently Random Values weakness

References