How severe is CVE-2016-8354?

CVE-2016-8354 has a CVSS 3.x base score of 7.0, rated high severity. It is exploitable over local access with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2016-8354 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2016-8354?

CVE-2016-8354 affects Schneider-electric Unity Pro. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2016-8354?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2016-8354 published?

CVE-2016-8354 was published on 2017-02-13 and last updated on 2026-06-17.

CVE-2016-8354

CVE-2016-8354 is a high-severity vulnerability in Schneider-electric Unity Pro with a CVSS 3.x base score of 7.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: High (CVSS 3.x base score 7.0)
CVSS v2: 5.1
EPSS exploit prediction: 1% (62nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-94
Affected product: Schneider-electric Unity Pro
Published: 2017-02-13
Last modified: 2026-06-17

Description

An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86 instructions are subsequently executed directly by the simulator. A specially crafted patched Unity project file can make the simulator execute malicious code by redirecting the control flow of these instructions.

Frequently asked questions

What is CVE-2016-8354?: An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86 instructions are subsequently executed directly by the simulator. A specially crafted patched Unity project file can make the simulator execute malicious code by redirecting the control flow of these instructions.
How severe is CVE-2016-8354?: CVE-2016-8354 has a CVSS 3.x base score of 7.0, rated high severity. It is exploitable over local access with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2016-8354 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-8354?: CVE-2016-8354 affects Schneider-electric Unity Pro. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2016-8354?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2016-8354 published?: CVE-2016-8354 was published on 2017-02-13 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:schneider-electric:unity_pro:*:*:*:*:*:*:*:*

More vulnerabilities in Schneider-electric Unity Pro

CVE-2020-7475 — Critical (CVSS 9.8): A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'),…
CVE-2013-0662 — Critical (CVSS 9.3): Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2…
CVE-2020-7560 — High (CVSS 8.6): A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity…
CVE-2014-9200 — High (CVSS 7.5): Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro,…
CVE-2019-6855 — High (CVSS 7.3): Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity…
CVE-2011-3330 — High (CVSS 7.2): Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC…

All CVEs affecting Schneider-electric Unity Pro →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →