CVE-2018-7828

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-22 · updated 2026-06-17
Weakness: CWE-352

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera.

Affected products

Schneider-Electric D6220 Firmware: from 2.11
Schneider-Electric D6220L Firmware: from 2.11
Schneider-Electric D6230 Firmware: from 2.11
Schneider-Electric D6230L Firmware: from 2.11
Schneider-Electric Ime119-1Ei Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1Ep Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1Es Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1I Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1P Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1S Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1Vi Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1Vp Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime119-1Vs Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1Ei Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1Ep Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1Es Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1I Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1P Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1S Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1Vi Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1Vp Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime219-1Vs Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1Ei Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1Ep Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1Es Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1I Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1P Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1S Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1Vi Firmware: before 2.2.3.0 — fixed in 2.2.3.0
Schneider-Electric Ime3122-1Vp Firmware: before 2.2.3.0 — fixed in 2.2.3.0

How to fix

Upgrade to a fixed version: Schneider-Electric Ime119-1Ei Firmware 2.2.3.0; Schneider-Electric Ime119-1Ep Firmware 2.2.3.0; Schneider-Electric Ime119-1Es Firmware 2.2.3.0; Schneider-Electric Ime119-1I Firmware 2.2.3.0; Schneider-Electric Ime119-1P Firmware 2.2.3.0; Schneider-Electric Ime119-1S Firmware 2.2.3.0; Schneider-Electric Ime119-1Vi Firmware 2.2.3.0; Schneider-Electric Ime119-1Vp Firmware 2.2.3.0; Schneider-Electric Ime119-1Vs Firmware 2.2.3.0; Schneider-Electric Ime219-1Ei Firmware 2.2.3.0; Schneider-Electric Ime219-1Ep Firmware 2.2.3.0; Schneider-Electric Ime219-1Es Firmware 2.2.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-7828 or the next vulnerability affects your stack