published March 9, 2018
⚠️ A crafty command execution opportunity is hanging around in Schneider Electric's Pelco Sarix Professional! 🔥 Think of it like a restaurant that lets you reorder a dish without checking your credentials—if you know the right words, you can whip up any meal you want, regardless of the chef’s rules! An attacker could exploit this oversight to execute arbitrary commands, potentially leading to unauthorized access or system alterations. While the risk of exploitation is currently unknown, the implications could be quite serious if leveraged.
Think of it like a restaurant that lets you reorder a dish without checking your credentials—if you know the right words, you can whip up any meal you want, regardless of the chef’s rules! This vulnerability arises from a lack of validation of shell meta characters in the 'network.ieee8021x.delete_certs' command, allowing unauthorized command execution under certain conditions.
An attacker could exploit this oversight to execute arbitrary commands, potentially leading to unauthorized access or system alterations. While the risk of exploitation is currently unknown, the implications could be quite serious if leveraged. To protect your system, update the firmware of your Pelco Sarix Professional to version 3.29.67 or later. Regularly review and secure command execution permissions to prevent unauthorized access. This is fixable! With these updates, you’re taking a solid step towards securing your systems. 🛡️