High severity · published Jun 5, 2018
CVE-2018-10597
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only),…
8.3
CVSS
0.4%
EPSS
No
On KEV
Description
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that allows an unauthenticated attacker to access memory ("write-what-where") from an attacker-chosen device address within the same subnet.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Avalon Fetal/maternal Monitors Fm20 Firmware · Philips
All versions, or not specified · source: NVD
AF
Avalon Fetal/maternal Monitors Fm30 Firmware · Philips
All versions, or not specified · source: NVD
AF
Avalon Fetal/maternal Monitors Fm40 Firmware · Philips
All versions, or not specified · source: NVD
AF
Avalon Fetal/maternal Monitors Fm50 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mp2 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mp30 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mp50 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mp70 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx100 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx400 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx450 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx500 Firmware · Philips
All versions, or not specified · source: NVD
Affected product
AF
Avalon Fetal/maternal Monitors Fm20 Firmware
Philips
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10597
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01
More from Avalon Fetal/maternal Monitors Fm20 Firmware
8.2
CVE-2018-10601
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only),…
5.3
CVE-2018-10599
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only),…