CVE-2018-7237

🗓️ 09 Mar 2018 23:00:00Reported by schneiderType

cve🔗 web.nvd.nist.gov👁 45 Views🌐 WEB

A vulnerability in Schneider Electric's Pelco Sarix Pro allows remote attackers to delete arbitrary system files in firmware versions prior to 3.29.67

Reporter	Title	Published	Views	Family All 6
CNVD	Schneider Electric Pelco Sarix Professional Arbitrary File Deletion Vulnerability	1 Mar 201800:00	–	cnvd
Cvelist	CVE-2018-7237	9 Mar 201823:00	–	cvelist
EUVD	EUVD-2018-18976	7 Oct 202500:30	–	euvd
NVD	CVE-2018-7237	9 Mar 201823:29	–	nvd
OSV	CVE-2018-7237	9 Mar 201823:29	–	osv
Prion	Design/Logic Flaw	9 Mar 201823:29	–	prion

NVD

Node

schneider-electric mps110-1_firmwareRange<3.29.67

AND

schneider-electric mps110-1Match-

Node

schneider-electric imps110-1er_firmwareRange<3.29.67

AND

schneider-electric imps110-1erMatch-

Node

schneider-electric ibps110-1er_firmwareRange<3.29.67

AND

schneider-electric ibps110-1erMatch-

Node

schneider-electric imp1110-1_firmwareRange<3.29.67

AND

schneider-electric imp1110-1Match-

Node

schneider-electric imp1110-1e_firmwareRange<3.29.67

AND

schneider-electric imp1110-1eMatch-

Node

schneider-electric imp1110-1er_firmwareRange<3.29.67

AND

schneider-electric imp1110-1erMatch-

Node

schneider-electric ibp1110-1er_firmwareRange<3.29.67

AND

schneider-electric ibp1110-1erMatch-

Node

schneider-electric imp219-1_firmwareRange<3.29.67

AND

schneider-electric imp219-1Match-

Node

schneider-electric imp219-1e_firmwareRange<3.29.67

AND

schneider-electric imp219-1eMatch-

Node

schneider-electric imp219-1er_firmwareRange<3.29.67

AND

schneider-electric imp219-1erMatch-

Node

schneider-electric ibp219-1er_firmwareRange<3.29.67

AND

schneider-electric ibp219-1erMatch-

Node

schneider-electric imp319-1_firmwareRange<3.29.67

AND

schneider-electric imp319-1Match-

Node

schneider-electric imp319-1e_firmwareRange<3.29.67

AND

schneider-electric imp319-1eMatch-

Node

schneider-electric ibp319-1er_firmwareRange<3.29.67

AND

schneider-electric ibp319-1erMatch-

Node

schneider-electric imp519-1_firmwareRange<3.29.67

AND

schneider-electric imp519-1Match-

Node

schneider-electric imp319-1er_firmwareRange<3.29.67

AND

schneider-electric imp319-1erMatch-

Node

schneider-electric imp519-1e_firmwareRange<3.29.67

AND

schneider-electric imp519-1eMatch-

Node

schneider-electric imp519-1er_firmwareRange<3.29.67

AND

schneider-electric imp519-1erMatch-

Node

schneider-electric ibp519-1er_firmwareRange<3.29.67

AND

schneider-electric ibp519-1erMatch-

Node

schneider-electric imps110-1e_firmwareRange<3.29.67

AND

schneider-electric imps110-1eMatch-

[
  {
    "product": "Pelco Sarix Professional",
    "vendor": "Schneider Electric SE",
    "versions": [
      {
        "status": "affected",
        "version": "all firmware versions prior to 3.29.77"
      }
    ]
  }
]

Source	Link
schneider-electric	www.schneider-electric.com/en/download/document/SEVD-2018-058-01/

Parameter	Position	Path	Description	CWE
param	request body	login/bin/set_param	Lack of validation of the file name when calling /login/bin/set_param enables remote deletion of arbitrary system files by sending a param value of 'system.delete.sd_file'	CWE-20

21 Nov 2024 04:11Current

9High risk

Vulners AI Score9

CVSS 26.4

CVSS 3.19.1

EPSS0.00527

CWE-20