Remote File Deletion Vulnerability in Schneider Electric's Pelco Sarix Professional
CVE-2018-7237

9.1CRITICAL

Key Information:

Vendor
Schneider Electric
Status
Pelco Sarix Professional
Vendor
CVE Published:
9 March 2018

Summary

A vulnerability in Schneider Electric's Pelco Sarix Professional allows remote attackers to exploit improper validation of user input, specifically in the /login/bin/set_param function. An attacker can manipulate the file name input to execute arbitrary deletions of system files, compromising the integrity and functionality of the affected system. All firmware versions prior to 3.29.67 are at risk, emphasizing the importance of updating to the latest firmware to mitigate this issue. For more information, refer to the official documentation.

Affected Version(s)

Pelco Sarix Professional all firmware versions prior to 3.29.77

References

https://www.schneider-electric.com/en/download/document/S...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.