CVE-2016-2278

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh (aka Minimal Shell) protection mechanism.

• CWE-284

• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-025-01Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01Third Party Advisory, US Government Resource
• https://www.exploit-db.com/exploits/39522/Third Party Advisory, VDB Entry
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-025-01Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01Third Party Advisory, US Government Resource
• https://www.exploit-db.com/exploits/39522/Third Party Advisory, VDB Entry

Published

Mar 2, 2016

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2272Eaton Lighting EG2 Web Control 4.04P and earlier allows remo…
• CVE-2016-2273Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-2274An issue was discovered in Adcon Telemetry A850 Telemetry Ga…
• CVE-2016-2275The web interface on Advantech/B+B SmartWorx VESP211-EU devi…
• CVE-2016-2276Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-2277IAB.exe in Rockwell Automation Integrated Architecture Build…
• CVE-2016-2279Cross-site scripting (XSS) vulnerability in the web server i…6.1
• CVE-2016-2280Buffer overflow in RDISERVER in Honeywell Uniformance Proces…
• CVE-2016-2281Untrusted search path vulnerability in ABB Panel Builder 800…
• CVE-2016-2282Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configura…
• CVE-2016-2283Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configura…
• CVE-2016-2284Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…