{"api_version":"1","generated_at":"2026-07-23T04:32:06+00:00","cve":"CVE-2017-9966","urls":{"html":"https://cve.report/CVE-2017-9966","api":"https://cve.report/api/cve/CVE-2017-9966.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-9966","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-9966"},"summary":{"title":"CVE-2017-9966","description":"A privilege escalation vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. By replacing certain files, an unauthorized user can obtain system privileges and the inserted code would execute at an elevated privilege level.","state":"PUBLIC","assigner":"cybersecurity@schneider-electric.com","published_at":"2018-01-02 03:29:00","updated_at":"2019-10-03 00:03:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://www.schneider-electric.com/en/download/document/SEVD-2017-339-01/","name":"https://www.schneider-electric.com/en/download/document/SEVD-2017-339-01/","refsource":"CONFIRM","tags":[],"title":"Security Notification - Pelco Video | Download Schneider Electric","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/102338","name":"102338","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Schneider Electric Pelco VideoXpert Enterprise Directory Traversal And Access Bypass Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-17-355-02","name":"https://ics-cert.us-cert.gov/advisories/ICSA-17-355-02","refsource":"MISC","tags":["Patch","Third Party Advisory","US Government Resource"],"title":"Schneider Electric Pelco VideoXpert Enterprise | ICS-CERT","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9966","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9966","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"9966","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"schneider-electric","cpe5":"pelco_videoxpert","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"9966","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"schneider-electric","cpe5":"pelco_videoxpert","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2017-9966","qid":"590837","title":"Schneider Electric Pelco VideoXpert Enterprise Multiple Vulnerabilities (ICSA-17-355-02)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cybersecurity@schneider-electric.com","DATE_PUBLIC":"2018-02-12T00:00:00","ID":"CVE-2017-9966","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Pelco VideoXpert Enterprise","version":{"version_data":[{"version_value":"Versions 2.0 and prior"}]}}]},"vendor_name":"Schneider Electric SE"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A privilege escalation vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. By replacing certain files, an unauthorized user can obtain system privileges and the inserted code would execute at an elevated privilege level."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Privilege Escalation"}]}]},"references":{"reference_data":[{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-17-355-02","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-17-355-02"},{"name":"https://www.schneider-electric.com/en/download/document/SEVD-2017-339-01/","refsource":"CONFIRM","url":"https://www.schneider-electric.com/en/download/document/SEVD-2017-339-01/"},{"name":"102338","refsource":"BID","url":"http://www.securityfocus.com/bid/102338"}]}},"nvd":{"publishedDate":"2018-01-02 03:29:00","lastModifiedDate":"2019-10-03 00:03:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":7.1},"severity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:schneider-electric:pelco_videoxpert:*:*:*:*:enterprise:*:*:*","versionEndExcluding":"2.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"9966","Ordinal":"107606","Title":"CVE-2017-9966","CVE":"CVE-2017-9966","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"9966","Ordinal":"1","NoteData":"A privilege escalation vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. By replacing certain files, an unauthorized user can obtain system privileges and the inserted code would execute at an elevated privilege level.","Type":"Description","Title":null},{"CveYear":"2017","CveId":"9966","Ordinal":"2","NoteData":"2018-01-01","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"9966","Ordinal":"3","NoteData":"2018-02-12","Type":"Other","Title":"Modified"}]}}}