CVE-2018-10601: ics-cert intellivue patient monitors, avalon fetal/maternal monitors Stack-based Buffer Overflow

Vulnerability summary

CVE-2018-10601 is a high (CVSS 8.2) Stack-based Buffer Overflow vulnerability in ics-cert intellivue patient monitors, avalon fetal/maternal monitors. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.6% of scored vulnerabilities.

Timeline

1. 05-06-2018
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.