Sign-up

ID

VAR-201803-1852


CVE

CVE-2018-7232


TITLE

Schneider Electric Pelco Sarix Professional Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-002610

DESCRIPTION

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'network.ieee8021x.delete_certs'. Schneider Electric Pelco Sarix Professional Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. An attacker could exploit the vulnerability to execute commands. Schneider Pelco Sarix Professional is prone to a remote command-execution vulnerability. Versions prior to Schneider Electric Pelco Sarix Professional 03.29.67 are vulnerable

Trust: 2.43

sources: NVD: CVE-2018-7232 // JVNDB: JVNDB-2018-002610 // CNVD: CNVD-2018-05326 // BID: 103472

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-05326

AFFECTED PRODUCTS

vendor:schneider electricmodel:imp519-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:mps110-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp519-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp319-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp219-1scope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imps110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1escope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:imp1110-1erscope:ltversion:3.29.67

Trust: 1.0

vendor:schneider electricmodel:ibp1110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:ibps110-1erscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imp1110-1scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:imps110-1escope: - version: -

Trust: 0.8

vendor:schneidermodel:electric pelco sarix professionalscope:ltversion:3.29.67

Trust: 0.6

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.65

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.63

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.59

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:eqversion:03.29.51

Trust: 0.3

vendor:schneider electricmodel:pelco sarix professionalscope:neversion:03.29.67

Trust: 0.3

sources: CNVD: CNVD-2018-05326 // BID: 103472 // JVNDB: JVNDB-2018-002610 // NVD: CVE-2018-7232

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-7232
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-7232
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-05326
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201803-049
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2018-7232
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-05326
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2018-7232
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2018-7232
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2018-05326 // JVNDB: JVNDB-2018-002610 // CNNVD: CNNVD-201803-049 // NVD: CVE-2018-7232

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2018-002610 // NVD: CVE-2018-7232

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-049

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201803-049

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-002610

PATCH
title:SEVD-2018-058-01url:https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=9607912128&p_File_Name=SEVD-2018-058-01+Pelco+Sarix+Professional+V1.2.pdf&p_Doc_Ref=SEVD-2018-058-01
Trust: 0.8
title:Patch for SchneiderElectricPelcoSarixProfessional Command Execution Vulnerability (CNVD-2018-05326)url:https://www.cnvd.org.cn/patchInfo/show/121569
Trust: 0.6
title:Schneider Electric Pelco Sarix Professional Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78843
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-05326 // 
            
            
            
            JVNDB: JVNDB-2018-002610 // 
            
            
            
            CNNVD: CNNVD-201803-049

EXTERNAL IDS
db:NVDid:CVE-2018-7232
Trust: 3.3
db:SCHNEIDERid:SEVD-2018-058-01
Trust: 1.9
db:JVNDBid:JVNDB-2018-002610
Trust: 0.8
db:CNVDid:CNVD-2018-05326
Trust: 0.6
db:CNNVDid:CNNVD-201803-049
Trust: 0.6
db:BIDid:103472
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-05326 // 
            
            
            
            BID: 103472 // 
            
            
            
            JVNDB: JVNDB-2018-002610 // 
            
            
            
            CNNVD: CNNVD-201803-049 // 
            
            
            
            NVD: CVE-2018-7232

REFERENCES
url:https://www.schneider-electric.com/en/download/document/sevd-2018-058-01/
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2018-7232
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7232
Trust: 0.8
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-05326 // 
            
            
            
            BID: 103472 // 
            
            
            
            JVNDB: JVNDB-2018-002610 // 
            
            
            
            CNNVD: CNNVD-201803-049 // 
            
            
            
            NVD: CVE-2018-7232

CREDITS
Deng Yongkai of NSFOCUS Security Team.
Trust: 0.3
sources:
            
            
            BID: 103472

SOURCES
db:CNVDid:CNVD-2018-05326
db:BIDid:103472
db:JVNDBid:JVNDB-2018-002610
db:CNNVDid:CNNVD-201803-049
db:NVDid:CVE-2018-7232

LAST UPDATE DATE
2024-11-23T21:39:29.534000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-05326date:2018-03-15T00:00:00
db:BIDid:103472date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-002610date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-049date:2022-02-07T00:00:00
db:NVDid:CVE-2018-7232date:2024-11-21T04:11:50.300

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-05326date:2018-03-15T00:00:00
db:BIDid:103472date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-002610date:2018-04-20T00:00:00
db:CNNVDid:CNNVD-201803-049date:2018-03-01T00:00:00
db:NVDid:CVE-2018-7232date:2018-03-09T23:29:00.593