CVE-2018-7230

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
Schneider Electric SEPelco Sarix Professionalall firmware versions prior to 3.29.70

References

Timeline

Published
Mar 9, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-72319.8A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow executioCVE-2018-72329.8A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow executioCVE-2018-72339.8A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow executioCVE-2018-72347.5A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrarCVE-2018-72357.5A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrarCVE-2018-72368.1A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH serCVE-2018-72379.1A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remoteCVE-2018-72389.8A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior tCVE-2018-72397.8A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior toCVE-2018-72408.8A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary codeCVE-2018-72419.8Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versionsCVE-2018-72429.8Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all
CVE-2018-7230: High severity, CVSS 8.8 | Vulnix