CVE-2018-7827

🗓️ 22 May 2019 19:33:25Reported by schneiderType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

A XSS vulnerability in Pelco Sarix Enhanced and Spectra Enhanced PTZ Cameras allows remote attackers to execute arbitrary code

Reporter	Title	Published	Views	Family All 8
CNVD	Schneider Electric 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera Cross-Site Request Forgery Vulnerability (CNVD-2019-16260)	24 May 201900:00	–	cnvd
Cvelist	CVE-2018-7827	22 May 201919:33	–	cvelist
EUVD	EUVD-2018-19539	7 Oct 202500:30	–	euvd
NVD	CVE-2018-7827	22 May 201920:29	–	nvd
OSV	CVE-2018-7827	22 May 201920:29	–	osv
Prion	Cross site scripting	22 May 201920:29	–	prion
RedhatCVE	CVE-2018-7827	22 May 202513:29	–	redhatcve
Zero Science Lab	Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities	10 Jul 201700:00	–	zeroscience

NVD

Node

schneider-electric d6220_firmwareRange2.11≥

AND

schneider-electric d6220Match-

Node

schneider-electric d6220l_firmwareRange2.11≥

AND

schneider-electric d6220lMatch-

Node

schneider-electric d6230_firmwareRange2.11≥

AND

schneider-electric d6230Match-

Node

schneider-electric d6230l_firmwareRange2.11≥

AND

schneider-electric d6230lMatch-

Node

schneider-electric imes19-1i_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1iMatch-

Node

schneider-electric imes19-1s_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1sMatch-

Node

schneider-electric imes19-1p_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1pMatch-

Node

schneider-electric ime119-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1iMatch-

Node

schneider-electric ime119-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1sMatch-

Node

schneider-electric ime119-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1pMatch-

Node

schneider-electric ime219-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1iMatch-

Node

schneider-electric ime219-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1sMatch-

Node

schneider-electric ime219-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1pMatch-

Node

schneider-electric ime319-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1iMatch-

Node

schneider-electric ime319-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1sMatch-

Node

schneider-electric ime319-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1pMatch-

Node

schneider-electric ime319-b1i_firmwareRange<2.2.3.0

AND

schneider-electric ime319-b1iMatch-

Node

schneider-electric ime319-b1s_firmwareRange<2.2.3.0

AND

schneider-electric ime319-b1sMatch-

Node

schneider-electric ime319-b1p_firmwareRange<2.2.3.0

AND

schneider-electric ime319-b1pMatch-

Node

schneider-electric ime3122-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1iMatch-

Node

schneider-electric ime3122-b1i_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-b1iMatch-

Node

schneider-electric ime3122-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1sMatch-

Node

schneider-electric ime3122-b1s_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-b1sMatch-

Node

schneider-electric ime3122-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1pMatch-

Node

schneider-electric ime3122-b1p_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-b1pMatch-

Node

schneider-electric imes19-1ei_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1eiMatch-

Node

schneider-electric imes19-1es_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1esMatch-

Node

schneider-electric imes19-1ep_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1epMatch-

Node

schneider-electric ime119-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1eiMatch-

Node

schneider-electric ime119-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1esMatch-

Node

schneider-electric ime119-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1epMatch-

Node

schneider-electric ime219-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1eiMatch-

Node

schneider-electric ime219-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1esMatch-

Node

schneider-electric ime219-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1epMatch-

Node

schneider-electric ime319-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1eiMatch-

Node

schneider-electric ime319-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1esMatch-

Node

schneider-electric ime319-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1epMatch-

Node

schneider-electric ime3122-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1eiMatch-

Node

schneider-electric ime3122-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1esMatch-

Node

schneider-electric ime3122-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1epMatch-

Node

schneider-electric imes19-1vi_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1viMatch-

Node

schneider-electric imes19-1vs_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1vsMatch-

Node

schneider-electric imes19-1vp_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1vpMatch-

Node

schneider-electric ime119-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1viMatch-

Node

schneider-electric ime119-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1vsMatch-

Node

schneider-electric ime119-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1vpMatch-

Node

schneider-electric ime219-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1viMatch-

Node

schneider-electric ime219-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1vsMatch-

Node

schneider-electric ime219-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1vpMatch-

Node

schneider-electric ime319-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1viMatch-

Node

schneider-electric ime319-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1vsMatch-

Node

schneider-electric ime319-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1vpMatch-

Node

schneider-electric ime3122-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1viMatch-

Node

schneider-electric ime3122-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1vsMatch-

Node

schneider-electric ime3122-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1vpMatch-

Node

schneider-electric ixes1_firmwareRange<2.2.3.0

AND

schneider-electric ixes1Match-

Node

schneider-electric ixe11_firmwareRange<2.2.3.0

AND

schneider-electric ixe11Match-

Node

schneider-electric ixe21_firmwareRange<2.2.3.0

AND

schneider-electric ixe21Match-

Node

schneider-electric ixe31_firmwareRange<2.2.3.0

AND

schneider-electric ixe31Match-

[
  {
    "product": "Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ"
      }
    ]
  }
]

Source	Link
schneider-electric	www.schneider-electric.com/en/download/document/SEVD-2019-045-03/

Parameter	Position	Path	Description	CWE
username	request body	192.168.1.1/setup/network/dot1x/update	XSS vulnerability via username parameter in POST form data.	CWE-79
hostname	request body	192.168.1.1/setup/network/general/update	XSS vulnerability via multiple network configuration parameters in POST form data.	CWE-79
http_port	request body	192.168.1.1/setup/network/general/update	XSS vulnerability via multiple network configuration parameters in POST form data.	CWE-79
rtsp_port	request body	192.168.1.1/setup/network/general/update	XSS vulnerability via multiple network configuration parameters in POST form data.	CWE-79
ip_address	request body	192.168.1.1/setup/network/general/update	XSS vulnerability via multiple network configuration parameters in POST form data.	CWE-79
subnet_mask	request body	192.168.1.1/setup/network/general/update	XSS vulnerability via multiple network configuration parameters in POST form data.	CWE-79
gateway	request body	192.168.1.1/setup/network/general/update	XSS vulnerability via multiple network configuration parameters in POST form data.	CWE-79
nameservers	request body	192.168.1.1/setup/network/general/update	XSS vulnerability via multiple network configuration parameters in POST form data.	CWE-79
version	request body	192.168.1.1/setup/network/snmp/update	XSS vulnerability via version parameter in POST form data.	CWE-79
device_name	request body	192.168.1.1/setup/system/general/update	XSS vulnerability via system/general settings parameters in POST form data.	CWE-79

21 Nov 2024 04:12Current

5.3Medium risk

Vulners AI Score5.3

CVSS 23.5

CVSS 35.4

EPSS0.00227

CWE-79