CVE-2018-10601 - CVE House
Back to Database
Status published High CVE-2018-10601

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue...

Vulnerability Description

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10601

Credits & Attribution

No credits recorded in the NVD database.

References

More from ICS-CERT

View All →
CVE-2019-6565
Moxa IKS and EDS fails to properly validate user input,...
Medium 6.1
CVE-2019-6563
Moxa IKS and EDS generate a predictable cookie calculated with...
Critical 9.8
CVE-2019-6561
Cross-site request forgery has been identified in Moxa IKS and...
High 8.8
CVE-2019-6559
Moxa IKS and EDS allow remote authenticated users to cause...
Medium 6.5
CVE-2019-6557
Several buffer overflow vulnerabilities have been identified in Moxa IKS...
Critical 9.8

Affected Vendor

Affected Software

IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors
Vulnerable Versions:
The following IntelliVue Patient Monitors versions are affected: IntelliVue Patient Monitors MP Series (includingMP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, and IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only). The following Avalon Fetal/Maternal Monitors versions are affected: Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3

Timeline

Official Publish: June 5th, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H

Weaknesses (CWE)

CWE-121

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1485 Data Destruction
Impact