When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includ…

published 2021-06-03 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19647

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.0%; EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, new password hash and replace it with an illegitimate hash. The user would no longer be able to authenticate to the controller (Micro800: All versions, MicroLogix 1400: Version 21 and later) causing a denial-of-service condition

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-145-02 updated 2021-05-25 cvss 6.1

Rockwell Automation Micro800 and MicroLogix 1400

Rockwell Automation Micro800 Rockwell Automation MicroLogix 1400 >= 21
affected: mitigation “Rockwell recommends confirming that setting and updating the password for the controller is done within a trusted network environment.” literature.rockwellautomation.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-06-04)

Exploit prediction

2.96% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

n/a Micro800, MicroLogix 1400

Classification

Weakness

CWE-300 Channel Accessible by Non-Endpoint

References

us-cert.cisa.gov /ics/advisories/icsa-21-145-02
third-party-advisory, us-government-resource

Sources

CVE List CVE-2021-32926
NVD CVE-2021-32926

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary