CVE-2018-7231
high-risk
Published 2018-03-09
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'system.opkg.remove'.
Do I need to act?
~
1.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (20)
Mps110-1 Firmware
Imps110-1Er Firmware
Ibps110-1Er Firmware
Imp1110-1 Firmware
Imp1110-1E Firmware
Imp1110-1Er Firmware
Ibp1110-1Er Firmware
Imp219-1 Firmware
Imp219-1E Firmware
Imp219-1Er Firmware
Ibp219-1Er Firmware
Imp319-1 Firmware
Imp319-1E Firmware
Ibp319-1Er Firmware
Imp519-1 Firmware
Imp319-1Er Firmware
Imp519-1E Firmware
Imp519-1Er Firmware
Ibp519-1Er Firmware
Imps110-1E Firmware
Affected Vendors
55
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
3/34 · Minimal
Exposure
20/34 · Moderate