VULNERABILITY INTELLIGENCE

CVE-2018-10601

CVSS score8.2 HIGH

EPSS probability0.37%

CISA KEVNot currently listed

Published2018-06-05

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H

Description

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.

Weakness classification

CWE-121: Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write

Primary references

ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource