Sign-up

ID

VAR-201801-1066


CVE

CVE-2017-9964


TITLE

Schneider Electric Pelco VideoXpert Enterprise Path traversal vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-011851 // CNNVD: CNNVD-201706-1084

DESCRIPTION

A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1. By sniffing communications, an unauthorized person can execute a directory traversal attack resulting in authentication bypass or session hijack. VideoXpert is a video management solution designed for scalability, suitable for any size monitoring operation. Attackers can use the vulnerabilities to obtain sensitive information. PelcoVideoXpertEnterprise is an enterprise video management system. SchneiderElectricPelcoVideoXpertEnterprise has a directory traversal vulnerability. Information harvested may aid in launching further attacks. Versions prior to Pelco VideoXpert Enterprise 2.1 are vulnerable. The vulnerability existdue to the improper permissions, with the 'F' flag (full) for the'Users' group, for several binary files. The service is installedby default to start on system boot with LocalSystem privileges.Attackers can replace the binary with their rootkit, and on rebootthey get SYSTEM privileges.<br/><br/>VideoXpert services also suffer from an unquoted search path issueimpacting the 'VideoXpert Core' and 'VideoXpert Exports' servicesfor Windows deployed as part of the VideoXpert Setup bundle. A successful attempt would require the local user to be able to inserttheir code in the system root path undetected by the OS or other securityapplications where it could potentially be executed during applicationstartup or reboot. If successful, the local user’s code would executewith the elevated privileges of the application.Tested on: Microsoft Windows 7 Professional SP1 (EN)

Trust: 3.24

sources: NVD: CVE-2017-9964 // JVNDB: JVNDB-2017-011851 // CNVD: CNVD-2017-23308 // CNVD: CNVD-2017-38302 // BID: 102338 // ZSL: ZSL-2017-5420 // ZSL: ZSL-2017-5419 // ZSL: ZSL-2017-5418

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-23308 // CNVD: CNVD-2017-38302

AFFECTED PRODUCTS

vendor:schneider electricmodel:pelco videoxpertscope:ltversion:2.1

Trust: 1.0

vendor:schneider electricmodel:pelco videoxpertscope:eqversion:enterprise 2.1

Trust: 0.8

vendor:schneider electricmodel:pelco videoxpertscope:ltversion:all versions

Trust: 0.8

vendor:schneidermodel:electric pelco videoxpertscope:eqversion:2.0.41

Trust: 0.6

vendor:schneidermodel:electric pelco videoxpertscope:eqversion:1.14.7

Trust: 0.6

vendor:schneidermodel:electric pelco videoxpertscope:eqversion:1.12.105

Trust: 0.6

vendor:schneidermodel:electric pelco videoxpert enterprisescope:ltversion:2.1

Trust: 0.6

vendor:schneider electricmodel:pelco videoxpert enterprisescope:eqversion:2.0

Trust: 0.3

vendor:schneider electricmodel:pelco videoxpert enterprisescope:neversion:2.1

Trust: 0.3

vendor:schneider electric semodel:pelco videoxpert missing encryption of sensitive informationscope:eqversion:2.0.41

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert missing encryption of sensitive informationscope:eqversion:1.14.7

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert missing encryption of sensitive informationscope:eqversion:1.12.105

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert core admin portal directory traversalscope:eqversion:2.0.41

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert core admin portal directory traversalscope:eqversion:1.14.7

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert core admin portal directory traversalscope:eqversion:1.12.105

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert privilege escalationsscope:eqversion:core software 1.12.105

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert privilege escalationsscope:eqversion:media gateway software 1.12.26

Trust: 0.1

vendor:schneider electric semodel:pelco videoxpert privilege escalationsscope:eqversion:exports 1.12

Trust: 0.1

sources: ZSL: ZSL-2017-5420 // ZSL: ZSL-2017-5419 // ZSL: ZSL-2017-5418 // CNVD: CNVD-2017-23308 // CNVD: CNVD-2017-38302 // BID: 102338 // JVNDB: JVNDB-2017-011851 // NVD: CVE-2017-9964

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9964
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-9964
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-23308
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2017-38302
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201706-1084
value: MEDIUM

Trust: 0.6

ZSL: ZSL-2017-5420
value: (3/5)

Trust: 0.1

ZSL: ZSL-2017-5419
value: (4/5)

Trust: 0.1

ZSL: ZSL-2017-5418
value: (3/5)

Trust: 0.1

nvd@nist.gov: CVE-2017-9964
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-23308
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2017-38302
severity: MEDIUM
baseScore: 6.1
vectorString: AV:N/AC:H/AU:N/C:P/I:C/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: COMPLETE
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2017-9964
baseSeverity: MEDIUM
baseScore: 6.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.6
impactScore: 4.7
version: 3.0

Trust: 1.8

sources: ZSL: ZSL-2017-5420 // ZSL: ZSL-2017-5419 // ZSL: ZSL-2017-5418 // CNVD: CNVD-2017-23308 // CNVD: CNVD-2017-38302 // JVNDB: JVNDB-2017-011851 // CNNVD: CNNVD-201706-1084 // NVD: CVE-2017-9964

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.8

sources: JVNDB: JVNDB-2017-011851 // NVD: CVE-2017-9964

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201706-1084

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201706-1084

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-011851

EXPLOIT AVAILABILITY
sources:
            
            
            ZSL: ZSL-2017-5420 // 
            
            
            
            ZSL: ZSL-2017-5419 // 
            
            
            
            ZSL: ZSL-2017-5418

PATCH
title:VideoXpert Enterprise Video Management Systemurl:https://www.pelco.com/video-management-system/videoxpert
Trust: 0.8
title:SchneiderElectricPelcoVideoXpertEnterprise directory traversal vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/111989
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-38302 // 
            
            
            
            JVNDB: JVNDB-2017-011851

EXTERNAL IDS
db:ICS CERTid:ICSA-17-355-02
Trust: 3.6
db:NVDid:CVE-2017-9964
Trust: 3.4
db:BIDid:102338
Trust: 1.6
db:SCHNEIDERid:SEVD-2017-339-01
Trust: 1.3
db:JVNDBid:JVNDB-2017-011851
Trust: 0.8
db:EXPLOIT-DBid:42312
Trust: 0.7
db:EXPLOITDBid:42312
Trust: 0.6
db:CNVDid:CNVD-2017-23308
Trust: 0.6
db:CNVDid:CNVD-2017-38302
Trust: 0.6
db:NSFOCUSid:38558
Trust: 0.6
db:CNNVDid:CNNVD-201706-1084
Trust: 0.6
db:CS-HELPid:SB2017122204
Trust: 0.3
db:ZSLid:ZSL-2017-5419
Trust: 0.2
db:AUSCERTid:ESB-2018.0004
Trust: 0.1
db:CXSECURITYid:WLB-2017070079
Trust: 0.1
db:PACKETSTORMid:143318
Trust: 0.1
db:ZSLid:ZSL-2017-5420
Trust: 0.1
db:CXSECURITYid:WLB-2017070077
Trust: 0.1
db:NVDid:CVE-2017-9965
Trust: 0.1
db:PACKETSTORMid:143317
Trust: 0.1
db:EXPLOIT-DBid:42311
Trust: 0.1
db:CXSECURITYid:WLB-2017070078
Trust: 0.1
db:NVDid:CVE-2017-9966
Trust: 0.1
db:PACKETSTORMid:143316
Trust: 0.1
db:EXPLOIT-DBid:42310
Trust: 0.1
db:ZSLid:ZSL-2017-5418
Trust: 0.1
sources:
            
            
            ZSL: ZSL-2017-5420 // 
            
            
            
            ZSL: ZSL-2017-5419 // 
            
            
            
            ZSL: ZSL-2017-5418 // 
            
            
            
            CNVD: CNVD-2017-23308 // 
            
            
            
            CNVD: CNVD-2017-38302 // 
            
            
            
            BID: 102338 // 
            
            
            
            JVNDB: JVNDB-2017-011851 // 
            
            
            
            CNNVD: CNNVD-201706-1084 // 
            
            
            
            NVD: CVE-2017-9964

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-355-02
Trust: 3.6
url:https://www.schneider-electric.com/en/download/document/sevd-2017-339-01/
Trust: 1.3
url:http://www.securityfocus.com/bid/102338
Trust: 1.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-9964
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9964
Trust: 0.8
url:https://www.exploit-db.com/exploits/42312/
Trust: 0.7
url:http://www.nsfocus.net/vulndb/38558
Trust: 0.6
url:https://www.schneider-electric.com/b2b/en/support/cybersecurity/security-notifications.jsp
Trust: 0.3
url:https://download.schneider-electric.com/files?p_endoctype=technical+leaflet&amp;p_file_id=8621588310&amp;p_file_name=sevd-2017-339-01-+pelco+videoxpert+enterprise.pdf&amp;p_reference=sevd-2017-339-01
Trust: 0.3
url:http://securityaffairs.co/wordpress/67108/hacking/pelco-videoxpert-flaws.html
Trust: 0.3
url:https://www.cybersecurity-help.cz/vdb/sb2017122204
Trust: 0.3
url:http://www.isssource.com/schneider-clears-pelco-vulnerabilities/
Trust: 0.3
url:http://www.securityweek.com/schneider-electric-patches-flaws-pelco-video-management-system
Trust: 0.3
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
url:http://www.zeroscience.mk/en/vulnerabilities/zsl-2017-5419.php
Trust: 0.1
url:https://cxsecurity.com/issue/wlb-2017070079
Trust: 0.1
url:https://packetstormsecurity.com/files/143318
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/129664
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9964
Trust: 0.1
url:https://www.auscert.org.au/bulletins/56446
Trust: 0.1
url:https://www.exploit-db.com/exploits/42311/
Trust: 0.1
url:https://cxsecurity.com/issue/wlb-2017070077
Trust: 0.1
url:https://packetstormsecurity.com/files/143317
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/129663
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9965
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-9965
Trust: 0.1
url:https://www.exploit-db.com/exploits/42310/
Trust: 0.1
url:https://packetstormsecurity.com/files/143316
Trust: 0.1
url:https://cxsecurity.com/issue/wlb-2017070078
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/129662
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9966
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-9966
Trust: 0.1
sources:
            
            
            ZSL: ZSL-2017-5420 // 
            
            
            
            ZSL: ZSL-2017-5419 // 
            
            
            
            ZSL: ZSL-2017-5418 // 
            
            
            
            CNVD: CNVD-2017-23308 // 
            
            
            
            CNVD: CNVD-2017-38302 // 
            
            
            
            BID: 102338 // 
            
            
            
            JVNDB: JVNDB-2017-011851 // 
            
            
            
            CNNVD: CNNVD-201706-1084 // 
            
            
            
            NVD: CVE-2017-9964

CREDITS
Vulnerability discovered by Gjoko Krstic
Trust: 0.3
sources:
            
            
            ZSL: ZSL-2017-5420 // 
            
            
            
            ZSL: ZSL-2017-5419 // 
            
            
            
            ZSL: ZSL-2017-5418

SOURCES
db:ZSLid:ZSL-2017-5420
db:ZSLid:ZSL-2017-5419
db:ZSLid:ZSL-2017-5418
db:CNVDid:CNVD-2017-23308
db:CNVDid:CNVD-2017-38302
db:BIDid:102338
db:JVNDBid:JVNDB-2017-011851
db:CNNVDid:CNNVD-201706-1084
db:NVDid:CVE-2017-9964

LAST UPDATE DATE
2024-11-23T21:39:52.905000+00:00

SOURCES UPDATE DATE
db:ZSLid:ZSL-2017-5420date:2018-01-13T00:00:00
db:ZSLid:ZSL-2017-5419date:2018-01-13T00:00:00
db:ZSLid:ZSL-2017-5418date:2018-01-13T00:00:00
db:CNVDid:CNVD-2017-23308date:2017-08-28T00:00:00
db:CNVDid:CNVD-2017-38302date:2017-12-28T00:00:00
db:BIDid:102338date:2017-12-21T00:00:00
db:JVNDBid:JVNDB-2017-011851date:2018-01-30T00:00:00
db:CNNVDid:CNNVD-201706-1084date:2018-01-03T00:00:00
db:NVDid:CVE-2017-9964date:2024-11-21T03:37:15.877

SOURCES RELEASE DATE
db:ZSLid:ZSL-2017-5420date:2017-07-10T00:00:00
db:ZSLid:ZSL-2017-5419date:2017-07-10T00:00:00
db:ZSLid:ZSL-2017-5418date:2017-07-10T00:00:00
db:CNVDid:CNVD-2017-23308date:2017-08-28T00:00:00
db:CNVDid:CNVD-2017-38302date:2017-12-28T00:00:00
db:BIDid:102338date:2017-12-21T00:00:00
db:JVNDBid:JVNDB-2017-011851date:2018-01-30T00:00:00
db:CNNVDid:CNNVD-201706-1084date:2017-06-27T00:00:00
db:NVDid:CVE-2017-9964date:2018-01-02T03:29:00.267