CVE-2018-7235
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of the shell meta characters with the value of 'system.download.sd_file'
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - cybersecurity@se.com
- Published
- 2018-03-09
- Last modified
- 2024-09-17
- Weaknesses
- CWE-20
Affected products
- Ibp1110-1er Firmware (Schneider-electric)
- Ibp219-1er Firmware (Schneider-electric)
- Ibp319-1er Firmware (Schneider-electric)
- Ibp519-1er Firmware (Schneider-electric)
- Ibps110-1er Firmware (Schneider-electric)
- Imp1110-1 Firmware (Schneider-electric)
- Imp1110-1e Firmware (Schneider-electric)
- Imp1110-1er Firmware (Schneider-electric)
- Imp219-1 Firmware (Schneider-electric)
- Imp219-1e Firmware (Schneider-electric)
- Imp219-1er Firmware (Schneider-electric)
- Imp319-1 Firmware (Schneider-electric)
- Imp319-1e Firmware (Schneider-electric)
- Imp319-1er Firmware (Schneider-electric)
- Imp519-1 Firmware (Schneider-electric)
- Imp519-1e Firmware (Schneider-electric)
- Imp519-1er Firmware (Schneider-electric)
- Imps110-1e Firmware (Schneider-electric)
- Imps110-1er Firmware (Schneider-electric)
- Mps110-1 Firmware (Schneider-electric)
- Pelco Sarix Professional (Schneider Electric Se)
References
- https://www.schneider-electric.com/en/download/document/SEVD-2018-058-01/
