CVE-2018-7827

🗓️ 22 May 2019 19:33:25Reported by schneiderType

cve🔗 web.nvd.nist.gov👁 82 Views🌐 WEB

A XSS vulnerability in Pelco Sarix Enhanced and Spectra Enhanced PTZ Cameras allows remote attackers to execute arbitrary code

Reporter	Title	Published	Views	Family All 9
BDU FSTEC	The vulnerability of the web interface of the microprogramming software for Pelco cameras, models Sarix Enhanced and Spectra Enhanced, allows a intruder to execute any JavaScript code in the user’s browser.	6 Mar 201900:00	–	bdu_fstec
CNVD	Schneider Electric 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera Cross-Site Request Forgery Vulnerability (CNVD-2019-16260)	24 May 201900:00	–	cnvd
Cvelist	CVE-2018-7827	22 May 201919:33	–	cvelist
EUVD	EUVD-2018-19539	7 Oct 202500:30	–	euvd
NVD	CVE-2018-7827	22 May 201920:29	–	nvd
OSV	CVE-2018-7827	22 May 201920:29	–	osv
Prion	Cross site scripting	22 May 201920:29	–	prion
RedhatCVE	CVE-2018-7827	22 May 202513:29	–	redhatcve
Zero Science Lab	Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities	10 Jul 201700:00	–	zeroscience

NVD

Node

schneider-electric d6220_firmwareRange2.11≥

AND

schneider-electric d6220Match-

Node

schneider-electric d6220l_firmwareRange2.11≥

AND

schneider-electric d6220lMatch-

Node

schneider-electric d6230_firmwareRange2.11≥

AND

schneider-electric d6230Match-

Node

schneider-electric d6230l_firmwareRange2.11≥

AND

schneider-electric d6230lMatch-

Node

schneider-electric imes19-1i_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1iMatch-

Node

schneider-electric imes19-1s_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1sMatch-

Node

schneider-electric imes19-1p_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1pMatch-

Node

schneider-electric ime119-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1iMatch-

Node

schneider-electric ime119-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1sMatch-

Node

schneider-electric ime119-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1pMatch-

Node

schneider-electric ime219-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1iMatch-

Node

schneider-electric ime219-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1sMatch-

Node

schneider-electric ime219-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1pMatch-

Node

schneider-electric ime319-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1iMatch-

Node

schneider-electric ime319-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1sMatch-

Node

schneider-electric ime319-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1pMatch-

Node

schneider-electric ime319-b1i_firmwareRange<2.2.3.0

AND

schneider-electric ime319-b1iMatch-

Node

schneider-electric ime319-b1s_firmwareRange<2.2.3.0

AND

schneider-electric ime319-b1sMatch-

Node

schneider-electric ime319-b1p_firmwareRange<2.2.3.0

AND

schneider-electric ime319-b1pMatch-

Node

schneider-electric ime3122-1i_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1iMatch-

Node

schneider-electric ime3122-b1i_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-b1iMatch-

Node

schneider-electric ime3122-1s_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1sMatch-

Node

schneider-electric ime3122-b1s_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-b1sMatch-

Node

schneider-electric ime3122-1p_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1pMatch-

Node

schneider-electric ime3122-b1p_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-b1pMatch-

Node

schneider-electric imes19-1ei_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1eiMatch-

Node

schneider-electric imes19-1es_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1esMatch-

Node

schneider-electric imes19-1ep_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1epMatch-

Node

schneider-electric ime119-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1eiMatch-

Node

schneider-electric ime119-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1esMatch-

Node

schneider-electric ime119-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1epMatch-

Node

schneider-electric ime219-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1eiMatch-

Node

schneider-electric ime219-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1esMatch-

Node

schneider-electric ime219-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1epMatch-

Node

schneider-electric ime319-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1eiMatch-

Node

schneider-electric ime319-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1esMatch-

Node

schneider-electric ime319-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1epMatch-

Node

schneider-electric ime3122-1ei_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1eiMatch-

Node

schneider-electric ime3122-1es_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1esMatch-

Node

schneider-electric ime3122-1ep_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1epMatch-

Node

schneider-electric imes19-1vi_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1viMatch-

Node

schneider-electric imes19-1vs_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1vsMatch-

Node

schneider-electric imes19-1vp_firmwareRange<2.2.3.0

AND

schneider-electric imes19-1vpMatch-

Node

schneider-electric ime119-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1viMatch-

Node

schneider-electric ime119-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1vsMatch-

Node

schneider-electric ime119-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime119-1vpMatch-

Node

schneider-electric ime219-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1viMatch-

Node

schneider-electric ime219-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1vsMatch-

Node

schneider-electric ime219-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime219-1vpMatch-

Node

schneider-electric ime319-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1viMatch-

Node

schneider-electric ime319-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1vsMatch-

Node

schneider-electric ime319-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime319-1vpMatch-

Node

schneider-electric ime3122-1vi_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1viMatch-

Node

schneider-electric ime3122-1vs_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1vsMatch-

Node

schneider-electric ime3122-1vp_firmwareRange<2.2.3.0

AND

schneider-electric ime3122-1vpMatch-

Node

schneider-electric ixes1_firmwareRange<2.2.3.0

AND

schneider-electric ixes1Match-

Node

schneider-electric ixe11_firmwareRange<2.2.3.0

AND

schneider-electric ixe11Match-

Node

schneider-electric ixe21_firmwareRange<2.2.3.0

AND

schneider-electric ixe21Match-

Node

schneider-electric ixe31_firmwareRange<2.2.3.0

AND

schneider-electric ixe31Match-

[
  {
    "product": "Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ"
      }
    ]
  }
]

Source	Link
schneider-electric	www.schneider-electric.com/en/download/document/SEVD-2019-045-03/

Parameter	Position	Path	Description	CWE
dot1x	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
protocol	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
inner_auth	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
username	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
password	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
anonymous_id	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
ca_certificate	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
client_certificate	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
private_key	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79
private_key_password	request body	setup/network/dot1x/update	XSS via user-controlled input in POST parameters leading to script execution in the browser.	CWE-79

17 Jun 2026 02:03Current

5.3Medium risk

Vulners AI Score5.3

CVSS 23.5

CVSS 35.4

EPSS0.00818

CWE-79