CVE-2018-7236

published 2018-03-09

CVE-2018-7236: A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of…

Priority P3 40 high 8.1 CVSS 3.1

AV N AC L PR N UI R S U C H I H A N

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	ibp1110-1er_firmware	< 3.29.67	3.29.67
schneider-electric	ibp219-1er_firmware	< 3.29.67	3.29.67
schneider-electric	ibp319-1er_firmware	< 3.29.67	3.29.67
schneider-electric	ibp519-1er_firmware	< 3.29.67	3.29.67
schneider-electric	ibps110-1er_firmware	< 3.29.67	3.29.67
schneider-electric	imp1110-1_firmware	< 3.29.67	3.29.67
schneider-electric	imp1110-1e_firmware	< 3.29.67	3.29.67
schneider-electric	imp1110-1er_firmware	< 3.29.67	3.29.67
schneider-electric	imp219-1_firmware	< 3.29.67	3.29.67
schneider-electric	imp219-1e_firmware	< 3.29.67	3.29.67
schneider-electric	imp219-1er_firmware	< 3.29.67	3.29.67
schneider-electric	imp319-1_firmware	< 3.29.67	3.29.67
schneider-electric	imp319-1e_firmware	< 3.29.67	3.29.67
schneider-electric	imp319-1er_firmware	< 3.29.67	3.29.67
schneider-electric	imp519-1_firmware	< 3.29.67	3.29.67
schneider-electric	imp519-1e_firmware	< 3.29.67	3.29.67
schneider-electric	imp519-1er_firmware	< 3.29.67	3.29.67
schneider-electric	imps110-1e_firmware	< 3.29.67	3.29.67
schneider-electric	imps110-1er_firmware	< 3.29.67	3.29.67
schneider-electric	mps110-1_firmware	< 3.29.67	3.29.67
schneider_electric_se	pelco_sarix_professional	—	—

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

nvd v2.0 5.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287