PT-2017-9632 · Schneider Electric · Unity Pro

Avihay Kain + 1 · Published 2017-02-13 · Updated 2017-03-15 · CVE-2016-8354

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric Unity PRO versions prior to V11.1

Description An issue was discovered where Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86 instructions are subsequently executed directly by the simulator. A specially crafted patched Unity project file can make the simulator execute malicious code by redirecting the control flow of these instructions.

Recommendations For versions prior to V11.1, update to version V11.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the PLC Simulator to minimize the risk of exploitation. Avoid loading patched Unity project files onto the simulator until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2016-8354

Affected Products

Unity Pro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8354 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8354 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-306-03 · Note
• http://securityfocus.com/bid/93830 · Note