Rockwell Automation MicroLogix Cleartext Transmission of Sensitive Information (CVE-2016-9334)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500181);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2016-9334");
  script_xref(name:"ICSA", value:"16-336-06");

  script_name(english:"Rockwell Automation MicroLogix Cleartext Transmission of Sensitive Information (CVE-2016-9334)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B,
Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A
and B, Version 14.000 and prior versions; and 1763-L16DWD, Series A and B, Version 14.000 and prior versions. User
credentials are sent to the web server in clear text, which may allow an attacker to discover the credentials if they
are able to observe traffic between the web browser and the server.

This plugin only works with Tenable.ot. Please
visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-16-336-06");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/95302");
# https://www.rockwellautomation.com/en-us/support/advisory.PN949.html
# script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e0ff3a8a");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-9334");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/02/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/02/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32awaa_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32awaa_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bxba_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16bbb_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16dwd_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16dwd_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16bwa_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bxb_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bwaa_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32awa_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16awa_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bwaa_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bwa_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bwa_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32awa_series_a");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bxba_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1766-l32bxb_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16awa_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16bbb_series_b");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rockwellautomation:1763-l16bwa_series_a");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/a:rockwellautomation:1766-l32awaa_series_a" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32awaa_series_b" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32bxba_series_a" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1763-l16bbb_series_a" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"},
    "cpe:/a:rockwellautomation:1763-l16dwd_series_b" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"},
    "cpe:/a:rockwellautomation:1763-l16dwd_series_a" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"},
    "cpe:/a:rockwellautomation:1763-l16bwa_series_b" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"},
    "cpe:/a:rockwellautomation:1766-l32bxb_series_a" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32bwaa_series_a" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32awa_series_b" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1763-l16awa_series_a" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"},
    "cpe:/a:rockwellautomation:1766-l32bwaa_series_b" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32bwa_series_a" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32bwa_series_b" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32awa_series_a" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32bxba_series_b" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1766-l32bxb_series_b" :
        {"versionEndIncluding" : "15.004", "family" : "MicroLogix1400"},
    "cpe:/a:rockwellautomation:1763-l16awa_series_b" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"},
    "cpe:/a:rockwellautomation:1763-l16bbb_series_b" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"},
    "cpe:/a:rockwellautomation:1763-l16bwa_series_a" :
        {"versionEndIncluding" : "14.000", "family" : "MicroLogix1100"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);