CVE-2016-2278

Name: CVE-2016-2278
Creator: NVD / NIST
Published: 2016-03-02T11:59:02.6+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 13.43%

Last modified Jun 17, 2026

CVE-2016-2278 is a vulnerability of currently unknown severity. Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh (aka Minimal Shell) protection mechanism.. EPSS estimates a 13.43% chance of exploitation in the next 30 days.

Description

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh (aka Minimal Shell) protection mechanism.

Metrics

EPSS Probability

13.43%

95.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-284

Affected Software

Vendor	Product	Versions
Schneider-Electric	Struxureware Building Operations Automation Server As Firmware	<= 1.7
Schneider-Electric	Struxureware Building Operations Automation Server As-P Firmware	1.7

References

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-025-01Vendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01Third Party Advisory, US Government Resource
https://www.exploit-db.com/exploits/39522/Third Party Advisory, VDB Entry
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-025-01Vendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01Third Party Advisory, US Government Resource
https://www.exploit-db.com/exploits/39522/Third Party Advisory, VDB Entry

Timeline

Published: Mar 2, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-2278?

How severe is CVE-2016-2278?

Severity scoring for CVE-2016-2278 is pending analysis. The EPSS model estimates a 13.43% probability of exploitation in the next 30 days.

How do I fix CVE-2016-2278?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-2278?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST