Schneider Electric Pelco Sarix Professional up to 3.29 Request Password access control

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Schneider Electric Pelco Sarix Professional up to 3.29. The impacted element is an unknown function. Performing a manipulation as part of Request results in access control (Password). This vulnerability was named CVE-2018-7781. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Schneider Electric Pelco Sarix Professional up to 3.29 (SCADA Software). This affects an unknown functionality. The manipulation as part of a Request leads to a access control vulnerability (Password). CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality. The summary by CVE is:

In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authenticated user can view password in clear text and results in privilege escalation.

The bug was discovered 04/24/2018. The weakness was presented 07/03/2018 (Website). It is possible to read the advisory at schneider-electric.com. This vulnerability is uniquely identified as CVE-2018-7781 since 03/08/2018. It is possible to initiate the attack remotely. The successful exploitation needs a authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 70 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3.29.69 eliminates this vulnerability.

See VDB-120302 and VDB-120304 for similar entries. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• SCADA Software

Vendor

• Schneider Electric

Name

• Pelco Sarix Professional

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29

License

• commercial

Website

• Vendor: https://www.schneider-electric.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion