CVE-2016-8354

low-risk

Published 2017-02-13

An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86 instructions are subsequently executed directly by the simulator. A specially crafted patched Unity project file can make the simulator execute malicious code by redirecting the control flow of these instructions.

Do I need to act?

0.16% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.0/10 High

LOCAL / HIGH complexity

Affected Products (1)

Unity Pro

Affected Vendors

Schneider-Electric

References (4)

Third Party Advisory http://www.securityfocus.com/bid/93830

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-306-03

Third Party Advisory http://www.securityfocus.com/bid/93830

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-306-03

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal