A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1.

Published 8 y ago 2018-01-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.9

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.0%

percentile 81%

Public exploits

none known

A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1. By sniffing communications, an unauthorized person can execute a directory traversal attack resulting in authentication bypass or session hijack.

Exploit prediction (EPSS)

1.99% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:P/A:N`

Affected products

Schneider Electric SE Pelco VideoXpert Enterprise

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

ics-cert.us-cert.gov /advisories/ICSA-17-355-02 · x_refsource_MISC, x_transferred
schneider-electric.com /en/download/document/SEVD-2017-339-01/ · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/102338 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2017-9964
NVD: CVE-2017-9964

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.