Schneider Electric Unity Pro vulnerabilities

7 CVEs affecting Schneider Electric Unity Pro, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7560, published 2020-12-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-0662, published 2014-04-01. High severity, CVSS 9.3. EPSS: 22.2% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a…
CVE-2014-9200, published 2015-02-01. High severity, CVSS 7.5. EPSS: 5.4% chance of exploitation in the next 30 days. Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier,…
CVE-2020-7475, published 2020-03-23. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to…
CVE-2020-7560, published 2020-12-11. High severity, CVSS 8.6. EPSS: 1.4% chance of exploitation in the next 30 days. A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a…
CVE-2011-3330, published 2011-11-04. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6…
CVE-2016-8354, published 2017-02-13. High severity, CVSS 7.0. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86…
CVE-2019-6855, published 2020-01-06. High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon…