← Advisories

Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information

Medium
Advisory ID
ZSL-2017-5420
Release Date
10 July 2017
Vendor
Schneider Electric SE - https://www.pelco.com
Affected Version
2.0.41, 1.14.7, 1.12.105
Tested On
Microsoft Windows 7 Professional SP1 (EN)
Summary

VideoXpert is a video management solution designed for scalability, fitting the needs surveillance operations of any size. VideoXpert Ultimate can also aggregate other VideoXpert systems, tying multiple video management systems into a single interface.

Description

The software transmits sensitive data using double Base64 encoding for the Cookie 'auth_token' in a communication channel that can be sniffed by unauthorized actors or arbitrarely be read from the vxcore log file directly using directory traversal attack resulting in authentication bypass / session hijacking.

Proof of Concept
Disclosure Timeline
05.04.2017Vulnerabilities discovered.
28.04.2017Vendor contacted.
09.07.2017No response from the vendor.
10.07.2017Public security advisory released.
05.12.2017Vendor releases version 2.1 to address this issue.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
10.07.2017Initial release
01.08.2017Added reference [2], [3] and [4]
07.08.2017Added reference [5]
05.12.2017Added vendor status
13.12.2017Added reference [5], [6], [7] and [8]
13.01.2018Added reference [9], [10], [11], [12], [13], [14], [15] and [16]