PT-2021-17303 · Pelco · Pelco Digital Sentry Server

Published 2021-02-11 · Updated 2021-02-18 · CVE-2021-27184

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Pelco Digital Sentry Server version 7.18.72.11464

Description: The issue is related to an XML External Entity vulnerability, which can be exploited via the DTD parameter entities technique. This results in the disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file in the %APPDATA%Pelco directory when DSControlPoint.exe is executed.

Recommendations: For Pelco Digital Sentry Server version 7.18.72.11464, as a temporary workaround, consider disabling the execution of DSControlPoint.exe until a patch is available. Restrict access to the ControlPointCacheShare.xml file to minimize the risk of exploitation. Avoid using unsanitized input when parsing XML files to prevent triggering the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-27184

Affected Products

Pelco Digital Sentry Server

References · 7

• 🔥 https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server.txt · Exploit
• https://osv.dev/vulnerability/CVE-2021-27184 · Vendor Advisory
• https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-history · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27184 · Security Note
• https://t.me/cvenotify/10078 · Telegram Post
• https://t.me/cibsecurity/23462 · Telegram Post
• https://t.me/cvenotify/9803 · Telegram Post