CVE-2017-7898 Auth bypass in Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400

Critical 9.8 Published 30 Jun 2017 Updated 3 Jun 2026

Attackers can bypass authentication on Rockwell Automation MicroLogix PLCs by repeatedly guessing passwords without lockout penalties.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-7898?

CVE-2017-7898 is a critical authentication bypass vulnerability in Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400, published on 30 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. There are no penalties for repeatedly entering incorrect passwords.

Weakness: CWE-307

Which versions are affected by CVE-2017-7898?

It affects 20 products.

Products include Rockwellautomation 1763-L16awa Series A, Rockwellautomation 1763-L16awa Series B, Rockwellautomation 1763-L16bbb Series A, Rockwellautomation 1763-L16bbb Series B, Rockwellautomation 1763-L16bwa Series A, Rockwellautomation 1763-L16bwa Series B and 14 more.

How do I fix CVE-2017-7898?

No fix has been published for CVE-2017-7898 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-7898 being exploited?

There is no known exploitation of CVE-2017-7898 in the wild and no public exploit code.

Sources

Also known as GHSA-cw68-r9hq-w87x.