Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Pro-face GP-Pro EX versions before 4.05 allow remote code execution

CVE-2016-2291 · published 10 years ago
Summary

Older versions of the Pro-face GP‑Pro EX software (EX‑ED, PFXEXEDV, PFXEXEDLS, and PFXEXGRPLS) can be tricked from across the network to run any program or crash the system. This could let an attacker take control of your equipment or make it stop working. Update to version 4.05.000 or later, or apply the vendor’s security patch, and limit network access to the system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
schneider-electric proface_gp-pro_ex_ex-ed <= 4.0.4
cpe:2.3:a:schneider-electric:proface_gp-pro_ex_ex-ed:*:*:*:*:*:*:*:*
schneider-electric proface_gp-pro_ex_pfxexedls <= 4.0.4
cpe:2.3:a:schneider-electric:proface_gp-pro_ex_pfxexedls:*:*:*:*:*:*:*:*
schneider-electric proface_gp-pro_ex_pfxexedv <= 4.0.4
cpe:2.3:a:schneider-electric:proface_gp-pro_ex_pfxexedv:*:*:*:*:*:*:*:*
schneider-electric proface_gp-pro_ex_pfxexgrpls <= 4.0.4
cpe:2.3:a:schneider-electric:proface_gp-pro_ex_pfxexgrpls:*:*:*:*:*:*:*:*
Original advisory text
Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of s...
Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published6 Apr 2016
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-2291 · NVD
Track software like this
Free during beta