CVE-2018-7234

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
Schneider Electric SEPelco Sarix Professionalall firmware versions prior to 3.29.74

References

Timeline

Published
Mar 9, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-72357.5A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrarCVE-2018-72368.1A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH serCVE-2018-72379.1A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remoteCVE-2018-72389.8A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior tCVE-2018-72397.8A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior toCVE-2018-72408.8A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary codeCVE-2018-72419.8Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versionsCVE-2018-72429.8Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all CVE-2018-72439.8An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MCVE-2018-72445.3An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS andCVE-2018-72459.1An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS andCVE-2018-72469.8A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse
CVE-2018-7234: High severity, CVSS 7.5 | Vulnix