CVE-2018-7238 A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attac...
CriticalCVSS 9.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric mps110-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imps110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibps110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp1110-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp1110-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp1110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp1110-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp219-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp219-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp219-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp219-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp319-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp319-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp319-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp519-1 firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp319-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp519-1e firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imp519-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric ibp519-1er firmware | < 3.29.67 | 3.29.67 |
| schneider-electric imps110-1e firmware | < 3.29.67 | 3.29.67 |
| Schneider Electric SE Pelco Sarix Professional | = all firmware versions prior to 3.29.78 | No fix listed |
References
- www.schneider-electric.com patch vendor-advisory