PT-2019-1489 · Pelco · Spectra Enhanced Ptz Camera+1

Published 2019-02-14 · Updated 2019-05-28 · CVE-2018-7828

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pelco Sarix Enhanced Camera (affected versions not specified) Spectra Enhanced PTZ Camera (affected versions not specified)

Description A Cross-Site Request Forgery (CSRF) issue exists, related to insufficient authentication checks for executed requests. This can be exploited when an authenticated user clicks a specially crafted malicious link while logged into the camera, potentially allowing an attacker to gain access to the camera.

Recommendations For Pelco Sarix Enhanced Camera, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Spectra Enhanced PTZ Camera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2019-00898

CVE-2018-7828

Affected Products

Pelco Sarix Enhanced Camera

Spectra Enhanced Ptz Camera

References · 6

• https://schneider-electric.com/en/download/document/SEVD-2019-045-03 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7828 · Security Note
• https://bdu.fstec.ru/vul/2019-00898 · Security Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-045-03-PelcoSarix-SpectraCameras.pdf&p_Doc_Ref=SEVD-2019-045-03 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-045-03-PelcoSarix-SpectraCameras.pdf&p_Doc_Ref=SEVD-2019-045-03 · Note