Priority MEDIUM 47
A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to execute arbit…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02772 · Published 2018-03-09 · Fixed in 3.29.78 CWE-120
Priority MEDIUM 46
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the va…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02049 · Published 2018-03-09 · Fixed in 3.29.73 CWE-20
Priority MEDIUM 46
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the va…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02049 · Published 2018-03-09 · Fixed in 3.29.72 CWE-20
Priority MEDIUM 46
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the va…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02049 · Published 2018-03-09 · Fixed in 3.29.71 CWE-20
Priority MEDIUM 46
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and gain administrator priv…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02188 · Published 2018-03-09 · Fixed in 3.29.69 CWE-798
Priority MEDIUM 46
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and get the administrator p…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02188 · Published 2018-03-09 · Fixed in 3.29.68 CWE-287
Priority MEDIUM 44
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi program "set".
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01185 · Published 2018-07-03 · No fix listed CWE-119
Priority MEDIUM 43
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /logi…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01723 · Published 2018-03-09 · Fixed in 3.29.77 CWE-20
Priority MEDIUM 41
A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01576 · Published 2018-03-09 · Fixed in 3.29.70 CWE-611
Priority LOW 39
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00799 · Published 2018-07-03 · No fix listed CWE-522
Priority LOW 39
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authenticated user can view password in clear text and results in p…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00593 · Published 2018-07-03 · No fix listed CWE-311
Priority LOW 38
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH ser…
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.01331 · Published 2018-03-09 · Fixed in 3.29.76 CWE-287
Priority LOW 36
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of the shell meta characters wi…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01632 · Published 2018-03-09 · Fixed in 3.29.75 CWE-20
Priority LOW 35
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00956 · Published 2018-03-09 · Fixed in 3.29.74 CWE-295
Priority LOW 26
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive in…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01202 · Published 2018-03-09 · Fixed in 3.29.67 CWE-287