VULNERABILITY INTELLIGENCE

CVE-2016-8354

CVSS score7 HIGH

EPSS probability1.10%

CISA KEVNot currently listed

Published2017-02-13

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86 instructions are subsequently executed directly by the simulator. A specially crafted patched Unity project file can make the simulator execute malicious code by redirecting the control flow of these instructions.

Weakness classification

CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references

ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource