Sign-up

ID

VAR-201803-1849


CVE

CVE-2018-7229


TITLE

Schneider Electric Pelco Sarix Professional Vulnerabilities related to the use of hard-coded credentials

Trust: 0.8

sources: JVNDB: JVNDB-2018-002607

DESCRIPTION

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and gain administrator privileges because the use of hardcoded credentials. Schneider Electric Pelco Sarix Professional Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. Schneider Pelco Sarix Professional is prone to an authentication-bypass vulnerability. Versions prior toSchneider Electric Pelco Sarix Professional 03.29.67 are vulnerable

Trust: 2.43

sources: NVD: CVE-2018-7229 // JVNDB: JVNDB-2018-002607 // CNVD: CNVD-2018-05322 // BID: 103460

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-05322

AFFECTED PRODUCTS

vendor:schneider electricmodel:imp519-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:mps110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:ibps110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imp1110-1scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imps110-1escope: - version: -

Trust: 0.8

vendor:schneidermodel:electric pelco sarix professionalscope:ltversion:3.29.67

Trust: 0.6

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.65

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.63

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.59

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.51

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:neversion:03.29.67

Trust: 0.3

sources: CNVD: CNVD-2018-05322 // BID: 103460 // JVNDB: JVNDB-2018-002607 // NVD: CVE-2018-7229

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-7229
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-7229
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-05322
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201803-046
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2018-7229
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-05322
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2018-7229
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2018-7229
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2018-05322 // JVNDB: JVNDB-2018-002607 // CNNVD: CNNVD-201803-046 // NVD: CVE-2018-7229

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.8

sources: JVNDB: JVNDB-2018-002607 // NVD: CVE-2018-7229

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-046

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201803-046

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-002607

PATCH
title:SEVD-2018-058-01url:https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=9607912128&p_File_Name=SEVD-2018-058-01+Pelco+Sarix+Professional+V1.2.pdf&p_Doc_Ref=SEVD-2018-058-01
Trust: 0.8
title:SchneiderElectricPelcoSarixProfessional privilege escalation vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/121561
Trust: 0.6
title:Schneider Electric Pelco Sarix Professional Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78840
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-05322 // 
            
            
            
            JVNDB: JVNDB-2018-002607 // 
            
            
            
            CNNVD: CNNVD-201803-046

EXTERNAL IDS
db:NVDid:CVE-2018-7229
Trust: 3.3
db:SCHNEIDERid:SEVD-2018-058-01
Trust: 1.9
db:JVNDBid:JVNDB-2018-002607
Trust: 0.8
db:CNVDid:CNVD-2018-05322
Trust: 0.6
db:CNNVDid:CNNVD-201803-046
Trust: 0.6
db:BIDid:103460
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-05322 // 
            
            
            
            BID: 103460 // 
            
            
            
            JVNDB: JVNDB-2018-002607 // 
            
            
            
            CNNVD: CNNVD-201803-046 // 
            
            
            
            NVD: CVE-2018-7229

REFERENCES
url:https://www.schneider-electric.com/en/download/document/sevd-2018-058-01/
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2018-7229
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7229
Trust: 0.8
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-05322 // 
            
            
            
            BID: 103460 // 
            
            
            
            JVNDB: JVNDB-2018-002607 // 
            
            
            
            CNNVD: CNNVD-201803-046 // 
            
            
            
            NVD: CVE-2018-7229

CREDITS
Deng Yongkai of NSFOCUS Security Team.
Trust: 0.3
sources:
            
            
            BID: 103460

SOURCES
db:CNVDid:CNVD-2018-05322
db:BIDid:103460
db:JVNDBid:JVNDB-2018-002607
db:CNNVDid:CNNVD-201803-046
db:NVDid:CVE-2018-7229

LAST UPDATE DATE
2024-11-23T21:39:29.745000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-05322date:2018-03-15T00:00:00
db:BIDid:103460date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-002607date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-046date:2022-02-07T00:00:00
db:NVDid:CVE-2018-7229date:2024-11-21T04:11:49.863

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-05322date:2018-03-15T00:00:00
db:BIDid:103460date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-002607date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-046date:2018-03-01T00:00:00
db:NVDid:CVE-2018-7229date:2018-03-09T23:29:00.437