Sign-up

ID

VAR-201803-1847


CVE

CVE-2018-7227


TITLE

Schneider Electric Pelco Sarix Professional Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2018-002605

DESCRIPTION

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker. Schneider Electric Pelco Sarix Professional Contains an information disclosure vulnerability.Information may be obtained. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. A security vulnerability exists in SchneiderElectricPelcoSarixProfessional with firmware prior to 3.25.67. An attacker could exploit this vulnerability to obtain sensitive information. Information obtained may aid in further attacks

Trust: 2.43

sources: NVD: CVE-2018-7227 // JVNDB: JVNDB-2018-002605 // CNVD: CNVD-2018-05324 // BID: 105842

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-05324

AFFECTED PRODUCTS

vendor:schneider electricmodel:imp519-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:mps110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:ibps110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imp1110-1scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imps110-1escope: - version: -

Trust: 0.8

vendor:schneidermodel:electric pelco sarix professionalscope:ltversion:3.29.67

Trust: 0.6

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.65

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.63

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.59

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.51

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:neversion:03.29.67

Trust: 0.3

sources: CNVD: CNVD-2018-05324 // BID: 105842 // JVNDB: JVNDB-2018-002605 // NVD: CVE-2018-7227

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-7227
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-7227
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2018-05324
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201803-044
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2018-7227
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-05324
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2018-7227
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2018-7227
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2018-05324 // JVNDB: JVNDB-2018-002605 // CNNVD: CNNVD-201803-044 // NVD: CVE-2018-7227

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.0

problemtype:CWE-200

Trust: 0.8

sources: JVNDB: JVNDB-2018-002605 // NVD: CVE-2018-7227

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-044

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201803-044

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-002605

PATCH
title:SEVD-2018-058-01url:https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=9607912128&p_File_Name=SEVD-2018-058-01+Pelco+Sarix+Professional+V1.2.pdf&p_Doc_Ref=SEVD-2018-058-01
Trust: 0.8
title:SchneiderElectricPelcoSarixProfessional Information Disclosure Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/121565
Trust: 0.6
title:Schneider Electric Pelco Sarix Professional Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78838
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-05324 // 
            
            
            
            JVNDB: JVNDB-2018-002605 // 
            
            
            
            CNNVD: CNNVD-201803-044

EXTERNAL IDS
db:NVDid:CVE-2018-7227
Trust: 3.3
db:SCHNEIDERid:SEVD-2018-058-01
Trust: 1.9
db:JVNDBid:JVNDB-2018-002605
Trust: 0.8
db:CNVDid:CNVD-2018-05324
Trust: 0.6
db:CNNVDid:CNNVD-201803-044
Trust: 0.6
db:BIDid:105842
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-05324 // 
            
            
            
            BID: 105842 // 
            
            
            
            JVNDB: JVNDB-2018-002605 // 
            
            
            
            CNNVD: CNNVD-201803-044 // 
            
            
            
            NVD: CVE-2018-7227

REFERENCES
url:https://www.schneider-electric.com/en/download/document/sevd-2018-058-01/
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2018-7227
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7227
Trust: 0.8
url:www.controlmicrosystems.com
Trust: 0.3
url:https://download.schneider-electric.com/files?p_endoctype=technical+leaflet&p_file_name=sevd-2018-058-01+pelco+sarix+professional+v1.2.pdf&p_doc_ref=sevd-2018-058-01
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-05324 // 
            
            
            
            BID: 105842 // 
            
            
            
            JVNDB: JVNDB-2018-002605 // 
            
            
            
            CNNVD: CNNVD-201803-044 // 
            
            
            
            NVD: CVE-2018-7227

CREDITS
Deng Yongkai of NSFOCUS Security Team
Trust: 0.3
sources:
            
            
            BID: 105842

SOURCES
db:CNVDid:CNVD-2018-05324
db:BIDid:105842
db:JVNDBid:JVNDB-2018-002605
db:CNNVDid:CNNVD-201803-044
db:NVDid:CVE-2018-7227

LAST UPDATE DATE
2024-11-23T21:39:29.378000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-05324date:2018-03-15T00:00:00
db:BIDid:105842date:2018-09-03T00:00:00
db:JVNDBid:JVNDB-2018-002605date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-044date:2022-02-07T00:00:00
db:NVDid:CVE-2018-7227date:2024-11-21T04:11:49.580

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-05324date:2018-03-15T00:00:00
db:BIDid:105842date:2018-09-03T00:00:00
db:JVNDBid:JVNDB-2018-002605date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-044date:2018-03-01T00:00:00
db:NVDid:CVE-2018-7227date:2018-03-09T23:29:00.217