Vulnerability Description
Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file (in a %APPDATA%\Pelco directory) when DSControlPoint.exe is executed.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pelco | Digital Sentry Server | 7.18.72.11464 |
Related Weaknesses (CWE)
References
- https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server.ExploitThird Party Advisory
- https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-Release NotesVendor Advisory
- https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server.ExploitThird Party Advisory
- https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-Release NotesVendor Advisory
FAQ
What is CVE-2021-27184?
CVE-2021-27184 is a vulnerability with a CVSS score of 7.5 (HIGH). Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on th...
How severe is CVE-2021-27184?
CVE-2021-27184 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27184?
Check the references section above for vendor advisories and patch information. Affected products include: Pelco Digital Sentry Server.