Sign-up

ID

VAR-201803-1845


CVE

CVE-2018-7238


TITLE

Schneider Electric Pelco Sarix Professional Buffer error vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2018-002616 // CNNVD: CNNVD-201803-055

DESCRIPTION

A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to execute arbitrary code. Schneider Electric Pelco Sarix Professional Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France

Trust: 2.16

sources: NVD: CVE-2018-7238 // JVNDB: JVNDB-2018-002616 // CNVD: CNVD-2018-05331

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-05331

AFFECTED PRODUCTS

vendor:schneider electricmodel:imp519-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:mps110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:ibps110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imp1110-1scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imps110-1escope: - version: -

Trust: 0.8

vendor:schneidermodel:electric pelco sarix professionalscope:ltversion:3.29.67

Trust: 0.6

sources: CNVD: CNVD-2018-05331 // JVNDB: JVNDB-2018-002616 // NVD: CVE-2018-7238

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-7238
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-7238
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-05331
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201803-055
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2018-7238
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-05331
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2018-7238
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2018-7238
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2018-05331 // JVNDB: JVNDB-2018-002616 // CNNVD: CNNVD-201803-055 // NVD: CVE-2018-7238

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:CWE-119

Trust: 0.8

sources: JVNDB: JVNDB-2018-002616 // NVD: CVE-2018-7238

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-055

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201803-055

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-002616

PATCH
title:SEVD-2018-058-01url:https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=9607912128&p_File_Name=SEVD-2018-058-01+Pelco+Sarix+Professional+V1.2.pdf&p_Doc_Ref=SEVD-2018-058-01
Trust: 0.8
title:Patch for SchneiderElectricPelcoSarixProfessional Buffer Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/121579
Trust: 0.6
title:Schneider Electric Pelco Sarix Professional Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78849
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-05331 // 
            
            
            
            JVNDB: JVNDB-2018-002616 // 
            
            
            
            CNNVD: CNNVD-201803-055

EXTERNAL IDS
db:NVDid:CVE-2018-7238
Trust: 3.0
db:SCHNEIDERid:SEVD-2018-058-01
Trust: 1.6
db:JVNDBid:JVNDB-2018-002616
Trust: 0.8
db:CNVDid:CNVD-2018-05331
Trust: 0.6
db:CNNVDid:CNNVD-201803-055
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-05331 // 
            
            
            
            JVNDB: JVNDB-2018-002616 // 
            
            
            
            CNNVD: CNNVD-201803-055 // 
            
            
            
            NVD: CVE-2018-7238

REFERENCES
url:https://www.schneider-electric.com/en/download/document/sevd-2018-058-01/
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2018-7238
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7238
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2018-05331 // 
            
            
            
            JVNDB: JVNDB-2018-002616 // 
            
            
            
            CNNVD: CNNVD-201803-055 // 
            
            
            
            NVD: CVE-2018-7238

SOURCES
db:CNVDid:CNVD-2018-05331
db:JVNDBid:JVNDB-2018-002616
db:CNNVDid:CNNVD-201803-055
db:NVDid:CVE-2018-7238

LAST UPDATE DATE
2024-11-23T21:39:29.441000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-05331date:2018-03-15T00:00:00
db:JVNDBid:JVNDB-2018-002616date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-055date:2022-02-07T00:00:00
db:NVDid:CVE-2018-7238date:2024-11-21T04:11:51.133

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-05331date:2018-03-15T00:00:00
db:JVNDBid:JVNDB-2018-002616date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-055date:2018-03-01T00:00:00
db:NVDid:CVE-2018-7238date:2018-03-09T23:29:00.920