CVE-2018-7237: Schneider Electric IBP1110-1er Firmware

Critical severity, CVSS 9.1. EPSS: 1.7% chance of exploitation in the next 30 days.

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/set_param to the file name with the value of 'system.delete.sd_file'

Affected products

• Schneider Electric IBP1110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBP219-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBP319-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBP519-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IBPS110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP1110-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP1110-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP1110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP219-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP219-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP219-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP319-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP319-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP319-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP519-1 Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP519-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMP519-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMPS110-1e Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric IMPS110-1er Firmware: before 3.29.67 (fixed in 3.29.67)
• Schneider Electric MPS110-1 Firmware: before 3.29.67 (fixed in 3.29.67)

Published 2018-03-09. Last modified 2026-06-17.