CVE-2018-7232 A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta ch...
CriticalCVSS 9.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'network.ieee8021x.delete_certs'.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric mps110-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imps110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibps110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp1110-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp1110-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp1110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp1110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp219-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp219-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp219-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp219-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp319-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp319-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp319-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp519-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp319-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp519-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp519-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp519-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imps110-1e firmware | < 3.29.67 | 3.29.67 |
| Schneider Electric SE Pelco Sarix Professional | = all firmware versions prior to 3.29.72 | No fix listed |
References
- www.schneider-electric.com patch vendor-advisory