What is the CVSS score of CVE-2016-9338?

CVE-2016-9338 has a CVSS 3.0 base score of 2.7 (Low). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

1763 L16Awa Series A CVE-2016-9338

LOW

2017-02-13 ics-cert@hq.dhs.gov

Rockwell Information Disclosure 1763 L16Awa Series A 1763 L16Awa Series B 1763 L16Bbb Series A 1763 L16Bbb Series B 1763 L16Bwa Series A 1763 L16Bwa Series B 1763 L16Dwd Series A 1763 L16Dwd Series B 1766 L32Awa Series A 1766 L32Awa Series B 1766 L32Awaa Series A 1766 L32Awaa Series B 1766 L32Bwa Series A 1766 L32Bwa Series B 1766 L32Bwaa Series A 1766 L32Bwaa Series B 1766 L32Bxb Series A 1766 L32Bxb Series B 1766 L32Bxba Series A 1766 L32Bxba Series B

2.7

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Feb 13, 2017 - 21:59 cve.org

LOW 2.7

DescriptionCVE.org

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD, Series A and B, Version 14.000 and prior versions. Because of an Incorrect Permission Assignment for Critical Resource, users with administrator privileges may be able to remove all administrative users requiring a factory reset to restore ancillary web server function. Exploitation of this vulnerability will still allow the affected device to function in its capacity as a controller.

AnalysisAI

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.