CVE-2018-7230: Schneider Electric IBP1110-1er Firmware

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67.

Affected products

• Schneider Electric IBP1110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBP219-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBP319-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBP519-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBPS110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP1110-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP1110-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP1110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP219-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP219-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP219-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP319-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP319-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP319-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP519-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP519-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP519-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMPS110-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMPS110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric MPS110-1 Firmware: before 3.29.67 (fixed in 3.29.67)

Published 2018-03-09. Last modified 2026-06-17.