CVE-2018-7236

CWE-287 — Improper Authentication3 documents3 sources
Severity
8.1HIGH
EPSS
0.2%
top 53.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
21
Schneider-electric Ibp1110-1er FirmwareSchneider-electric Ibp219-1er FirmwareSchneider-electric Ibp319-1er Firmware+18 more
Timeline
PublishedMar 9
Latest updateMay 13

Description

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages21 packages

▶CVEListV5schneider_electric_se/pelco_sarix_professionalall firmware versions prior to 3.29.76

Patches

Patch: www.schneider-electric.com ↗Patch: www.schneider-electric.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9rxc-jvqg-fv36: A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3↗2022-05-13
▶
CVEList
CVE-2018-7236: A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3↗2018-03-09
▶
CVE-2018-7236 (HIGH CVSS 8.1) | A vulnerability exists in Schneider | cvebase.io