CVE-2021-32926CWE-300

When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate…

Medium · published June 3, 2021

CVSS v3.1
5.9
EPSS
3%
Percentile
87.2
In the wild
Unconfirmed
What it is

When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, new password hash and replace it with an illegitimate hash. The user would no longer be able to authenticate to the controller (Micro800: All versions, MicroLogix 1400: Version 21 and later) causing a denial-of-service condition

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02982 · 87.2th percentile
Weakness
CWE-300 · Channel Accessible by Non-Endpoint
Published
2021-06-03T12:35Z
EPSS history
Timeline
  • 03 JUN 12:35Z
    When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate…
    cvelistv5