VAR-201803-1847
Vulnerability from variot - Updated: 2024-11-23 21:39A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker. Schneider Electric Pelco Sarix Professional Contains an information disclosure vulnerability.Information may be obtained. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. A security vulnerability exists in SchneiderElectricPelcoSarixProfessional with firmware prior to 3.25.67. An attacker could exploit this vulnerability to obtain sensitive information. Information obtained may aid in further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201803-1847",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "imp519-1e",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "ibp219-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "ibp319-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "ibp519-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imps110-1e",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp219-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp519-1",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp319-1",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp219-1e",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp319-1e",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "ibps110-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp1110-1",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "mps110-1",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp519-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp319-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp219-1",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imps110-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp1110-1e",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "ibp1110-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "imp1110-1er",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "3.29.67"
},
{
"model": "ibp1110-1er",
"scope": null,
"trust": 0.8,
"vendor": "schneider electric",
"version": null
},
{
"model": "ibps110-1er",
"scope": null,
"trust": 0.8,
"vendor": "schneider electric",
"version": null
},
{
"model": "imp1110-1",
"scope": null,
"trust": 0.8,
"vendor": "schneider electric",
"version": null
},
{
"model": "imps110-1e",
"scope": null,
"trust": 0.8,
"vendor": "schneider electric",
"version": null
},
{
"model": "electric pelco sarix professional",
"scope": "lt",
"trust": 0.6,
"vendor": "schneider",
"version": "3.29.67"
},
{
"model": "pelco sarix professional",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "03.29.65"
},
{
"model": "pelco sarix professional",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "03.29.63"
},
{
"model": "pelco sarix professional",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "03.29.59"
},
{
"model": "pelco sarix professional",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "03.29.51"
},
{
"model": "pelco sarix professional",
"scope": "ne",
"trust": 0.3,
"vendor": "schneider electric",
"version": "03.29.67"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"db": "BID",
"id": "105842"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:schneider_electric:ibp1110-1er_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:schneider_electric:ibps110-1er_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:schneider_electric:imp1110-1_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:schneider_electric:imps110-1e_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Deng Yongkai of NSFOCUS Security Team",
"sources": [
{
"db": "BID",
"id": "105842"
}
],
"trust": 0.3
},
"cve": "CVE-2018-7227",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-7227",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-05324",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2018-7227",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2018-7227",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-7227",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2018-7227",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2018-05324",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-044",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-044"
},
{
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability exists in Schneider Electric\u0027s Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker. Schneider Electric Pelco Sarix Professional Contains an information disclosure vulnerability.Information may be obtained. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. A security vulnerability exists in SchneiderElectricPelcoSarixProfessional with firmware prior to 3.25.67. An attacker could exploit this vulnerability to obtain sensitive information. Information obtained may aid in further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-7227"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"db": "BID",
"id": "105842"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-7227",
"trust": 3.3
},
{
"db": "SCHNEIDER",
"id": "SEVD-2018-058-01",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2018-05324",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201803-044",
"trust": 0.6
},
{
"db": "BID",
"id": "105842",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"db": "BID",
"id": "105842"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-044"
},
{
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"id": "VAR-201803-1847",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
}
],
"trust": 1.5078947299999998
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
}
]
},
"last_update_date": "2024-11-23T21:39:29.378000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SEVD-2018-058-01",
"trust": 0.8,
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Id=9607912128\u0026p_File_Name=SEVD-2018-058-01+Pelco+Sarix+Professional+V1.2.pdf\u0026p_Doc_Ref=SEVD-2018-058-01"
},
{
"title": "SchneiderElectricPelcoSarixProfessional Information Disclosure Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/121565"
},
{
"title": "Schneider Electric Pelco Sarix Professional Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78838"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-044"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.0
},
{
"problemtype": "CWE-200",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://www.schneider-electric.com/en/download/document/sevd-2018-058-01/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-7227"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7227"
},
{
"trust": 0.3,
"url": "www.controlmicrosystems.com"
},
{
"trust": 0.3,
"url": "https://download.schneider-electric.com/files?p_endoctype=technical+leaflet\u0026p_file_name=sevd-2018-058-01+pelco+sarix+professional+v1.2.pdf\u0026p_doc_ref=sevd-2018-058-01"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"db": "BID",
"id": "105842"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-044"
},
{
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"db": "BID",
"id": "105842"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-044"
},
{
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"date": "2018-09-03T00:00:00",
"db": "BID",
"id": "105842"
},
{
"date": "2018-04-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"date": "2018-03-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-044"
},
{
"date": "2018-03-09T23:29:00.217000",
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05324"
},
{
"date": "2018-09-03T00:00:00",
"db": "BID",
"id": "105842"
},
{
"date": "2018-04-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-002605"
},
{
"date": "2022-02-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-044"
},
{
"date": "2024-11-21T04:11:49.580000",
"db": "NVD",
"id": "CVE-2018-7227"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-044"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Schneider Electric Pelco Sarix Professional Vulnerable to information disclosure",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-002605"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-044"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…