Skip to content
Fencer Intel
medium 5.3

CVE-2016-8367 json

An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, a…

published 2017-02-13 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-9215

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.3%
EPSS 4.3% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker can open multiple connections to a targeted web server and keep connections open preventing new connections from being made, rendering the web server unavailable during an attack.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-16-308-02B updated cvss 5.3

Schneider Electric Magelis HMI Resource Consumption Vulnerabilities (Update B)

  • Schneider Electric Magelis GTO Advanced Optimum Panels Schneider Electric Magelis GTU Universal Panel Schneider Electric Magelis STO5xx and STU Small panels Schneider Electric Magelis XBT GH Advanced Hand-held Panels Schneider Electric Magelis XBT GK Advanced Touchscreen Panels with Keyboard Schneider Electric Magelis XBT GT Advanced Touchscreen Panels
    +1 more products
    Schneider Electric Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe)
    affected: mitigation “Schneider Electric has released a new version of Vijeo XD, Version 2.4.2, which does not integrate the web server feature containing the identified vulnerabilities.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

4.30% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • n/a Schneider Electric Magelis HMI

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.