Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal
Title: Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal
Advisory ID: ZSL-2017-5419
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (4/5)
Release Date: 10.07.2017
1.14.7
1.12.105
[28.04.2017] Vendor contacted.
[09.07.2017] No response from the vendor.
[10.07.2017] Public security advisory released.
[05.12.2017] Vendor releases version 2.1 to address this issue.
[2] https://cxsecurity.com/issue/WLB-2017070077
[3] https://packetstormsecurity.com/files/143317
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/129663
[5] https://www.schneider-electric.com/b2b/en/support/cybersecurity/security-notifications.jsp
[6] https://www.schneider-electric.com/en/download/document/SEVD-2017-339-01/
[7] SEVD-2017-339-01- Pelco VideoXpert Enterprise (.pdf)
[8] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9965
[9] https://ics-cert.us-cert.gov/advisories/ICSA-17-355-02
[10] https://www.securityfocus.com/bid/102338
[11] http://securityaffairs.co/wordpress/67108/hacking/pelco-videoxpert-flaws.html
[12] https://www.cybersecurity-help.cz/vdb/SB2017122204
[13] https://nvd.nist.gov/vuln/detail/CVE-2017-9965
[14] http://www.isssource.com/schneider-clears-pelco-vulnerabilities/
[15] http://www.securityweek.com/schneider-electric-patches-flaws-pelco-video-management-system
[01.08.2017] - Added reference [1], [2] and [3]
[07.08.2017] - Added reference [4]
[05.12.2017] - Added vendor status
[13.12.2017] - Added reference [5], [6], [7] and [8]
[13.01.2018] - Added reference [9], [10], [11], [12], [13], [14] and [15]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2017-5419
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (4/5)
Release Date: 10.07.2017
Summary
VideoXpert is a video management solution designed for scalability, fitting the needs surveillance operations of any size. VideoXpert Ultimate can also aggregate other VideoXpert systems, tying multiple video management systems into a single interface.Description
Pelco VideoXpert suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server.Vendor
Schneider Electric SE - https://www.pelco.comAffected Version
2.0.411.14.7
1.12.105
Tested On
Microsoft Windows 7 Professional SP1 (EN)Vendor Status
[05.04.2017] Vulnerabilities discovered.[28.04.2017] Vendor contacted.
[09.07.2017] No response from the vendor.
[10.07.2017] Public security advisory released.
[05.12.2017] Vendor releases version 2.1 to address this issue.
PoC
pelcovideoxpert_fd.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://www.exploit-db.com/exploits/42311/[2] https://cxsecurity.com/issue/WLB-2017070077
[3] https://packetstormsecurity.com/files/143317
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/129663
[5] https://www.schneider-electric.com/b2b/en/support/cybersecurity/security-notifications.jsp
[6] https://www.schneider-electric.com/en/download/document/SEVD-2017-339-01/
[7] SEVD-2017-339-01- Pelco VideoXpert Enterprise (.pdf)
[8] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9965
[9] https://ics-cert.us-cert.gov/advisories/ICSA-17-355-02
[10] https://www.securityfocus.com/bid/102338
[11] http://securityaffairs.co/wordpress/67108/hacking/pelco-videoxpert-flaws.html
[12] https://www.cybersecurity-help.cz/vdb/SB2017122204
[13] https://nvd.nist.gov/vuln/detail/CVE-2017-9965
[14] http://www.isssource.com/schneider-clears-pelco-vulnerabilities/
[15] http://www.securityweek.com/schneider-electric-patches-flaws-pelco-video-management-system
Changelog
[10.07.2017] - Initial release[01.08.2017] - Added reference [1], [2] and [3]
[07.08.2017] - Added reference [4]
[05.12.2017] - Added vendor status
[13.12.2017] - Added reference [5], [6], [7] and [8]
[13.01.2018] - Added reference [9], [10], [11], [12], [13], [14] and [15]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
