CVE-2016-8354: Code Injection
First published: Mon Feb 13 2017(Updated: )
An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86 instructions are subsequently executed directly by the simulator. A specially crafted patched Unity project file can make the simulator execute malicious code by redirecting the control flow of these instructions.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Unity Pro | <=11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-8354?
CVE-2016-8354 is classified as a high-severity vulnerability.
What software versions are affected by CVE-2016-8354?
CVE-2016-8354 affects Schneider Electric Unity PRO versions prior to 11.1.
How do I fix CVE-2016-8354?
To fix CVE-2016-8354, upgrade Schneider Electric Unity PRO to version 11.1 or later.
What type of vulnerability is CVE-2016-8354?
CVE-2016-8354 is a vulnerability that allows for the execution of specially crafted instructions via the PLC Simulator.
Who is affected by CVE-2016-8354?
Organizations using Schneider Electric Unity PRO versions prior to 11.1 are at risk due to CVE-2016-8354.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/unity pro
- version/unity pro/11.0