Lucene search

SchneiderCVE-2018-7227

HistoryMar 09, 2018 - 11:29 p.m.

CVE-2018-7227

2018-03-0923:29:00

CWE-287

schneider

web.nvd.nist.gov

schneider electric

pelco

sarix professional

firmware

vulnerability

unauthorized access

information disclosure

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

35.5%

JSON

A vulnerability exists in Schneider Electric’s Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker.

Affected configurations

Nvd

Node

schneider-electricmps110-1Match-

AND

schneider-electricmps110-1_firmwareRange<3.29.67

Node

schneider-electricimps110-1erMatch-

AND

schneider-electricimps110-1er_firmwareRange<3.29.67

Node

schneider-electricibps110-1erMatch-

AND

schneider-electricibps110-1er_firmwareRange<3.29.67

Node

schneider-electricimp1110-1Match-

AND

schneider-electricimp1110-1_firmwareRange<3.29.67

Node

schneider-electricimp1110-1eMatch-

AND

schneider-electricimp1110-1e_firmwareRange<3.29.67

Node

schneider-electricimp1110-1erMatch-

AND

schneider-electricimp1110-1er_firmwareRange<3.29.67

Node

schneider-electricibp1110-1erMatch-

AND

schneider-electricibp1110-1er_firmwareRange<3.29.67

Node

schneider-electricimp219-1Match-

AND

schneider-electricimp219-1_firmwareRange<3.29.67

Node

schneider-electricimp219-1e_firmwareRange<3.29.67

AND

schneider-electricimp219-1eMatch-

Node

schneider-electricimp219-1er_firmwareRange<3.29.67

AND

schneider-electricimp219-1erMatch-

Node

schneider-electricibp219-1er_firmwareRange<3.29.67

AND

schneider-electricibp219-1erMatch-

Node

schneider-electricimp319-1_firmwareRange<3.29.67

AND

schneider-electricimp319-1Match-

Node

schneider-electricimp319-1e_firmwareRange<3.29.67

AND

schneider-electricimp319-1eMatch-

Node

schneider-electricibp319-1er_firmwareRange<3.29.67

AND

schneider-electricibp319-1erMatch-

Node

schneider-electricimp519-1_firmwareRange<3.29.67

AND

schneider-electricimp519-1Match-

Node

schneider-electricimp319-1er_firmwareRange<3.29.67

AND

schneider-electricimp319-1erMatch-

Node

schneider-electricimp519-1e_firmwareRange<3.29.67

AND

schneider-electricimp519-1eMatch-

Node

schneider-electricimp519-1er_firmwareRange<3.29.67

AND

schneider-electricimp519-1erMatch-

Node

schneider-electricibp519-1er_firmwareRange<3.29.67

AND

schneider-electricibp519-1erMatch-

Node

schneider-electricimps110-1e_firmwareRange<3.29.67

AND

schneider-electricimps110-1eMatch-

VendorProductVersionCPE
schneider-electricmps110-1-cpe:2.3:h:schneider-electric:mps110-1:-:*:*:*:*:*:*:*
schneider-electricmps110-1_firmware*cpe:2.3:o:schneider-electric:mps110-1_firmware:*:*:*:*:*:*:*:*
schneider-electricimps110-1er-cpe:2.3:h:schneider-electric:imps110-1er:-:*:*:*:*:*:*:*
schneider-electricimps110-1er_firmware*cpe:2.3:o:schneider-electric:imps110-1er_firmware:*:*:*:*:*:*:*:*
schneider-electricibps110-1er-cpe:2.3:h:schneider-electric:ibps110-1er:-:*:*:*:*:*:*:*
schneider-electricibps110-1er_firmware*cpe:2.3:o:schneider-electric:ibps110-1er_firmware:*:*:*:*:*:*:*:*
schneider-electricimp1110-1-cpe:2.3:h:schneider-electric:imp1110-1:-:*:*:*:*:*:*:*
schneider-electricimp1110-1_firmware*cpe:2.3:o:schneider-electric:imp1110-1_firmware:*:*:*:*:*:*:*:*
schneider-electricimp1110-1e-cpe:2.3:h:schneider-electric:imp1110-1e:-:*:*:*:*:*:*:*
schneider-electricimp1110-1e_firmware*cpe:2.3:o:schneider-electric:imp1110-1e_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	mps110-1	-	cpe:2.3:h:schneider-electric:mps110-1:-:::::::*
schneider-electric	mps110-1_firmware	*	cpe:2.3:o:schneider-electric:mps110-1_firmware::::::::
schneider-electric	imps110-1er	-	cpe:2.3:h:schneider-electric:imps110-1er:-:::::::*
schneider-electric	imps110-1er_firmware	*	cpe:2.3:o:schneider-electric:imps110-1er_firmware::::::::
schneider-electric	ibps110-1er	-	cpe:2.3:h:schneider-electric:ibps110-1er:-:::::::*
schneider-electric	ibps110-1er_firmware	*	cpe:2.3:o:schneider-electric:ibps110-1er_firmware::::::::
schneider-electric	imp1110-1	-	cpe:2.3:h:schneider-electric:imp1110-1:-:::::::*
schneider-electric	imp1110-1_firmware	*	cpe:2.3:o:schneider-electric:imp1110-1_firmware::::::::
schneider-electric	imp1110-1e	-	cpe:2.3:h:schneider-electric:imp1110-1e:-:::::::*
schneider-electric	imp1110-1e_firmware	*	cpe:2.3:o:schneider-electric:imp1110-1e_firmware::::::::

Rows per page:

1-10 of 401

CNA Affected

[
  {
    "product": "Pelco Sarix Professional",
    "vendor": "Schneider Electric SE",
    "versions": [
      {
        "status": "affected",
        "version": "all firmware versions prior to 3.29.67"
      }
    ]
  }
]

References

www.schneider-electric.com/en/download/document/SEVD-2018-058-01/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

35.5%

JSON

Related for CVE-2018-7227