CVE-2018-7237

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/set_param to the file name with the value of 'system.delete.sd_file'

Score

CVSS 3.1 9.1 Critical

Status

Modified - cybersecurity@se.com

Published

2018-03-09

Last modified

2024-09-16

Weaknesses

CWE-20

Affected products

• Ibp1110-1er Firmware (Schneider-electric)
• Ibp219-1er Firmware (Schneider-electric)
• Ibp319-1er Firmware (Schneider-electric)
• Ibp519-1er Firmware (Schneider-electric)
• Ibps110-1er Firmware (Schneider-electric)
• Imp1110-1 Firmware (Schneider-electric)
• Imp1110-1e Firmware (Schneider-electric)
• Imp1110-1er Firmware (Schneider-electric)
• Imp219-1 Firmware (Schneider-electric)
• Imp219-1e Firmware (Schneider-electric)
• Imp219-1er Firmware (Schneider-electric)
• Imp319-1 Firmware (Schneider-electric)
• Imp319-1e Firmware (Schneider-electric)
• Imp319-1er Firmware (Schneider-electric)
• Imp519-1 Firmware (Schneider-electric)
• Imp519-1e Firmware (Schneider-electric)
• Imp519-1er Firmware (Schneider-electric)
• Imps110-1e Firmware (Schneider-electric)
• Imps110-1er Firmware (Schneider-electric)
• Mps110-1 Firmware (Schneider-electric)
• Pelco Sarix Professional (Schneider Electric Se)

References

• https://www.schneider-electric.com/en/download/document/SEVD-2018-058-01/