Schneider Electric Pelco VideoXpert Enterprise Directory Traversal And Access Bypass Vulnerabilities
BID:102338
CVE-2017-9964 | CVE-2017-9965 | CVE-2017-9966 |Info
Schneider Electric Pelco VideoXpert Enterprise Directory Traversal And Access Bypass Vulnerabilities
| Bugtraq ID: | 102338 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-9964 CVE-2017-9965 CVE-2017-9966 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2017 12:00AM |
| Updated: | Dec 21 2017 12:00AM |
| Credit: | Gjoko Krstic |
| Vulnerable: |
Schneider-Electric Pelco VideoXpert Enterprise 2.0 |
| Not Vulnerable: |
Schneider-Electric Pelco VideoXpert Enterprise 2.1 |
Discussion
Schneider Electric Pelco VideoXpert Enterprise Directory Traversal And Access Bypass Vulnerabilities
Schneider Electric Pelco VideoXpert Enterprise is prone to multiple directory traversal and an access-bypass vulnerabilities.
Exploiting these issues will allow an attacker to bypass security restrictions, execute arbitrary code and perform unauthorized actions. Information harvested may aid in launching further attacks.
Versions prior to Pelco VideoXpert Enterprise 2.1 are vulnerable.
Schneider Electric Pelco VideoXpert Enterprise is prone to multiple directory traversal and an access-bypass vulnerabilities.
Exploiting these issues will allow an attacker to bypass security restrictions, execute arbitrary code and perform unauthorized actions. Information harvested may aid in launching further attacks.
Versions prior to Pelco VideoXpert Enterprise 2.1 are vulnerable.
Exploit / POC
Schneider Electric Pelco VideoXpert Enterprise Directory Traversal And Access Bypass Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Schneider Electric Pelco VideoXpert Enterprise Directory Traversal And Access Bypass Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Schneider Electric Pelco VideoXpert Enterprise Directory Traversal And Access Bypass Vulnerabilities
References:
References:
- Schneider Electric Homepage (Schneider Electric)
- ICSA-17-355-02: Schneider Electric Pelco VideoXpert Enterprise (CERT)