CVE-2018-7233

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.8CRITICAL
EPSS
1.1%
top 21.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
21
Schneider-electric Ibp1110-1er FirmwareSchneider-electric Ibp219-1er FirmwareSchneider-electric Ibp319-1er Firmware+18 more
Timeline
PublishedMar 9
Latest updateMay 13

Description

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'model_name' or 'mac_address'.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages21 packages

▶CVEListV5schneider_electric_se/pelco_sarix_professionalall firmware versions prior to 3.29.73

Patches

Patch: www.schneider-electric.com ↗Patch: www.schneider-electric.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-949j-6rq4-px75: A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3↗2022-05-13
▶
CVEList
CVE-2018-7233: A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3↗2018-03-09
▶
CVE-2018-7233 (CRITICAL CVSS 9.8) | A vulnerability exists in Schneider | cvebase.io