LiveActive security incident?Get immediate response
CVE Record

CVE-2018-7233: A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3...

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'model_name' or 'mac_address'.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Schneider Electric disclosed a command execution flaw in Pelco Sarix Professional camera firmware. The issue comes from insufficient validation of shell metacharacters in model_name or mac_address values. A successful attack could let an attacker run commands on an affected camera. Public sources provided do not confirm active exploitation.

Executive priority

Treat this as a high-priority remediation item for sites using the affected cameras, especially where cameras sit on sensitive networks. The business concern is device command execution, but urgency should be tempered by the lack of confirmed exploitation in the provided sources.

Technical view

CVE-2018-7233 affects Schneider Electric Pelco Sarix Professional firmware before the fixed release threshold. The CVE text cites command execution caused by missing validation of shell metacharacters in model_name or mac_address. The bundle has no CVSS, CWE, authentication context, or detailed attack path.

Likely exposure

Exposure is limited to environments running Schneider Electric Pelco Sarix Professional cameras on affected firmware. The bundle conflicts on the fixed-version boundary, citing versions prior to 3.29.67 in the description and prior to 3.29.73 in affected-product data.

Exploitation context

The CVE is not listed as CISA KEV in the provided bundle, and no cited source confirms active exploitation. The available evidence supports command execution risk, but not exploit availability, exploitation scale, authentication requirements, or internet-facing prevalence.

Researcher notes

The source bundle is sparse. It identifies command execution via shell metacharacter validation failures, but omits CVSS, CWE, privilege requirements, affected interfaces, and reliable fixed-version detail. Validate against the Schneider advisory before asserting exact exposure or closure criteria.

Mitigation direction

  • Review Schneider advisory SEVD-2018-058-01 for the authoritative fixed firmware version.
  • Upgrade affected Pelco Sarix Professional cameras to vendor-recommended firmware.
  • Inventory camera firmware versions and prioritize devices below the vendor fixed release.
  • Restrict camera management exposure while firmware status is being verified.

Validation and detection

  • Identify all deployed Pelco Sarix Professional cameras.
  • Record current firmware versions from asset inventory or device administration records.
  • Compare versions against Schneider advisory SEVD-2018-058-01.
  • Confirm whether model_name or mac_address handling is relevant to deployed configurations.
  • Document remediation status and any version-threshold uncertainty.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-7233 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Schneider Electric SEPelco Sarix Professionalall firmware versions prior to 3.29.73Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.