CVE-2018-7237

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/setparam to the file name with the value of 'system.delete.sdfile'...

CVE-2018-7232

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'network.ieee8021x.deletecerts'...

CVE-2018-7227

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker...

CVE-2018-7229

The CVE-2018-7229 entry affects Schneider Electric’s Pelco Sarix Professional video surveillance devices. All firmware versions prior to 3.29.67 are vulnerable to an unauthenticated, remote attacker who can bypass authentication and obtain administrator privileges due to the use of hardcoded cred...

CVE-2018-7230

A XML external entity XXE vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67...

CVE-2018-7227

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker...

CVE-2018-7229

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and gain administrator privileges because the use of hardcoded credentials...

CVE-2018-7234

Schneider Electric Pelco Sarix Professional devices running firmware older than 3.29.67 are affected by an arbitrary system file download vulnerability. The issue arises from insufficient validation in SSL/TLS handling, enabling an attacker to download arbitrary files via the /cgi-bin/ssldownload...

CVE-2018-7232

CVE-2018-7232 affects Schneider Electric’s Pelco Sarix Professional, all firmware versions prior to 3.29.67. The root cause is a lack of validation of shell metacharacters in the value of 'network.ieee8021x.delete_certs', which can permit command execution. Impact is high (per CVSS:3.1 base score...

CVE-2018-7230

CVE-2018-7230 affects Schneider Electric Pelco Sarix Professional web interface component, specifically the import.cgi handling in the web UI. The root cause is an XML External Entity (XXE) processing vulnerability in all firmware versions prior to 3.29.67. Reported impacts are consistent with XX...

CVE-2018-7235

Schneider Electric Pelco Sarix Professional devices running firmware before 3.29.67 are vulnerable to arbitrary system file download caused by lack of validation of shell metacharacters in the system.download.sd_file parameter. Exploitation is network-vector with high impact (CVE-2018-7235; CVSS ...

CVE-2018-7236

Schneider Electric Pelco Sarix Professional cameras (firmware

CVE-2018-7231

CVE-2018-7231 affects Schneider Electric’s Pelco Sarix Professional cameras. All firmware versions prior to 3.29.67 are vulnerable to remote command execution due to lack of validation of shell metacharacters in the value of 'system.opkg.remove'. The issue resides in the command execution path an...

CVE-2018-7237

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/setparam to the file name with the value of 'system.delete.sdfile'...

CVE-2018-7228

Schneider Electric Pelco Sarix Professional cameras with firmware versions prior to 3.29.67 are affected by an authentication bypass vulnerability that allows an unauthenticated remote attacker to gain administrator privileges. The root cause is an authentication bypass mechanism in all prior fir...

CVE-2018-7232

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'network.ieee8021x.deletecerts'...

CVE-2018-7233

CVE-2018-7233 affects Schneider Electric’s Pelco Sarix Professional, with firmware versions prior to 3.29.67. The vulnerability arises from lack of validation of shell metacharacters in the values of model_name or mac_address, enabling command execution. The NVD data lists a high/critical impact ...

CVE-2018-7236

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/setparam could enable SSH service...

CVE-2018-7227

CVE-2018-7227 affects Schneider Electric Pelco Sarix Professional cameras. All firmware versions prior to 3.29.67 are vulnerable to an information-disclosure issue where specially crafted URLs can be retrieved without authentication, potentially revealing sensitive information to an attacker. The...

CVE-2018-7238

The CVE-2018-7238 entry affects Schneider Electric Pelco Sarix Professional devices. A buffer overflow in the web-based GUI is exploitable on all firmware versions prior to 3.29.67, allowing an unauthenticated, remote attacker to execute arbitrary code. Impact is high: remote code execution with ...