CVE-2018-7236

HIGH

8.1

Description

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service.

CVE Details

CVSS v3.1 Score8.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published3/9/2018

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

schneider-electric:ibp1110-1erschneider-electric:ibp1110-1er_firmwareschneider-electric:ibp219-1erschneider-electric:ibp219-1er_firmwareschneider-electric:ibp319-1erschneider-electric:ibp319-1er_firmwareschneider-electric:ibp519-1erschneider-electric:ibp519-1er_firmwareschneider-electric:ibps110-1erschneider-electric:ibps110-1er_firmwareschneider-electric:imp1110-1schneider-electric:imp1110-1_firmwareschneider-electric:imp1110-1eschneider-electric:imp1110-1e_firmwareschneider-electric:imp1110-1erschneider-electric:imp1110-1er_firmwareschneider-electric:imp219-1schneider-electric:imp219-1_firmwareschneider-electric:imp219-1eschneider-electric:imp219-1e_firmwareschneider-electric:imp219-1erschneider-electric:imp219-1er_firmwareschneider-electric:imp319-1schneider-electric:imp319-1_firmwareschneider-electric:imp319-1eschneider-electric:imp319-1e_firmwareschneider-electric:imp319-1erschneider-electric:imp319-1er_firmwareschneider-electric:imp519-1schneider-electric:imp519-1_firmwareschneider-electric:imp519-1eschneider-electric:imp519-1e_firmwareschneider-electric:imp519-1erschneider-electric:imp519-1er_firmwareschneider-electric:imps110-1eschneider-electric:imps110-1e_firmwareschneider-electric:imps110-1erschneider-electric:imps110-1er_firmwareschneider-electric:mps110-1schneider-electric:mps110-1_firmware

Weaknesses (CWE)

CWE-287

References

https://www.schneider-electric.com/en/download/document/SEVD-2018-058-01/(cybersecurity@se.com)

https://www.schneider-electric.com/en/download/document/SEVD-2018-058-01/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.