CVE-2017-7898

CVE-2017-7898 describes an Improper Restriction of Excessive Authentication Attempts vulnerability in various Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs) running version 16.00 and prior. This flaw allows unlimited incorrect password attempts, making the devices susceptible to brute-force attacks. Rated as Critical with a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low attack complexity, requiring no user interaction. A successful exploit could lead to complete compromise of confidentiality, integrity, and availability of the affected PLCs. While there is no evidence of active exploitation or publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community. It is not listed on the CISA KEV catalog.