« Back to list

CVE-2016-5645

Status: ModifiedHigh (7.3)—

Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP community, which makes it easier for remote attackers to load arbitrary firmware updates by leveraging knowledge of this community.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (6)

Rockwellautomation — 1766-l32awaRockwellautomation — 1766-l32awaaRockwellautomation — 1766-l32bwaRockwellautomation — 1766-l32bwaaRockwellautomation — 1766-l32bxbRockwellautomation — 1766-l32bxba

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2016-5645",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2016-5645",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T13:14:46.443989Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-08-24T02:00:12.823",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/92428",
      "source": "cret@cert.org"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-224-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/92428",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-224-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP community, which makes it easier for remote attackers to load arbitrary firmware updates by leveraging knowledge of this community."
    },
    {
      "lang": "es",
      "value": "Dispositivos Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA y 1766-L32BXBA tienen una comunidad SNMP codificada, lo que facilita a atacantes remotos cargar actualizaciones de firmware arbitrarias aprovechando el conocimiento de esta comunidad."
    }
  ],
  "lastModified": "2026-06-17T00:49:48.730",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:1766-l32awa:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EC2A03F-A665-4874-896C-B603110BADA0"
            },
            {
              "criteria": "cpe:2.3:h:rockwellautomation:1766-l32awaa:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55E42B9C-4D13-48DE-A522-28B1FA1B943E"
            },
            {
              "criteria": "cpe:2.3:h:rockwellautomation:1766-l32bwa:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF023FAE-BC4D-4DB7-830E-0A522C8E51CC"
            },
            {
              "criteria": "cpe:2.3:h:rockwellautomation:1766-l32bwaa:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3250570F-0A69-4484-BD7F-012AC8A2DC7F"
            },
            {
              "criteria": "cpe:2.3:h:rockwellautomation:1766-l32bxb:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3BFF3BE-77D5-4D28-831A-13136D8E0B6D"
            },
            {
              "criteria": "cpe:2.3:h:rockwellautomation:1766-l32bxba:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F03C6CFA-F770-4BCA-BB74-BD0D43C250F7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}