PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8354 Schneider Electric CVE debrief

CVE-2016-8354 describes a code-execution flaw in Schneider Electric Unity PRO where Unity projects compiled as x86 instructions can be loaded into the bundled PLC Simulator and executed directly. A specially crafted patched Unity project file can redirect control flow so the simulator runs malicious code. The issue was published on 2017-02-13 and is associated with Unity PRO versions prior to V11.1, with NVD’s CPE data indicating vulnerability through 11.0.

Vendor
Schneider Electric
Product
Unity Pro
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2016-08-05
Original CVE updated
2025-06-05
Advisory published
2016-08-05
Advisory updated
2025-06-05

Who should care

Organizations using Schneider Electric Unity PRO, especially teams that develop, test, or validate PLC logic in the Unity PLC Simulator. OT security teams and engineers responsible for engineering workstation hardening and project-file handling should treat this as relevant because the attack path depends on local interaction with a crafted project file.

Technical summary

NVD maps the weakness to CWE-94 and rates the vector as AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The core issue is that Unity projects may be compiled as x86 instructions and then executed by the PLC Simulator; a maliciously patched project file can alter control flow and cause arbitrary code execution in the simulator context. The official data places affected Unity PRO versions below V11.1, while the NVD CPE range marks versions up to 11.0 as vulnerable.

Defensive priority

High for affected engineering workstations and simulator environments, because successful exploitation can lead to code execution with significant confidentiality, integrity, and availability impact, even though the attack requires local access and user interaction.

Recommended defensive actions

  • Verify whether Schneider Electric Unity PRO is installed and whether any systems are running versions prior to V11.1.
  • Treat Unity project files from untrusted or unexpected sources as high risk and restrict who can open or modify them.
  • Limit access to engineering workstations used for PLC development and simulator use.
  • Apply the vendor remediation or upgrade path referenced by Schneider Electric and confirm the environment is on a fixed version.
  • Monitor for unexpected simulator crashes, abnormal project-file changes, or unauthorized use of Unity PRO on engineering assets.
  • Review backup, integrity, and change-control processes for Unity project files before testing or deployment.

Evidence notes

This debrief is based only on the supplied NVD record and linked official references. The published CVE date used here is 2017-02-13, not the later modification date. Version scope is taken from the supplied description and NVD CPE criteria, which together indicate exposure before V11.1 and through 11.0. External references listed by NVD include ICS-CERT advisory ICSA-16-306-03 and SecurityFocus BID 93830.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8354 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8354

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8354 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8354

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.