Unity Pro
Vendor:
First CVE: Nov 4, 2011 · Active for 14 years
7
Total CVEs
More Total CVEs than 83% of tracked products
1.4
Avg CVEs / Year
Higher CVE frequency than 56% of tracked products
8.1
Avg CVSS
Higher Avg CVSS than 70% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Unity Pro over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 4, 2011
14 years ago
Most Recent CVE
Dec 11, 2020
2,052 days ago
CVE Severity & Scoring
Unity Pro7 CVEs
86%
14%
All CVEs352,708 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local2 (28.6%)
Network2 (28.6%)
Unknown3 (42.9%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (42.9%)
High1 (14.3%)
Unknown3 (42.9%)
User Interaction
None2 (28.6%)
Unknown3 (42.9%)
Required2 (28.6%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None4 (57.1%)
Unknown3 (42.9%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-0662HIGH Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buff | Apr 1, 2014 | 9.3 | 52 | NO | YES |
CVE-2020-7475CRITICAL A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (al | Mar 23, 2020 | 9.8 | 30 | NO | NO |
CVE-2014-9200HIGH Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 | Feb 1, 2015 | 7.5 | 27 | NO | NO |
CVE-2020-7560HIGH A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), | Dec 11, 2020 | 8.6 | 22 | NO | NO |
CVE-2011-3330HIGH Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique | Nov 4, 2011 | 7.2 | 22 | NO | NO |
CVE-2016-8354HIGH An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PR | Feb 13, 2017 | 7.0 | 20 | NO | NO |
CVE-2019-6855HIGH Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20 | Jan 6, 2020 | 7.3 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
14.3% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Unity Pro
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.0 | 1 | 9.3 | 22.3% | 0 | 1 |