CVE-2018-10601
Description
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| philips intellivue_mp2_firmware | No range specified | — |
| philips intellivue_x2_firmware | No range specified | — |
| philips intellivue_mp30_firmware | No range specified | — |
| philips intellivue_mp50_firmware | No range specified | — |
| philips intellivue_mp70_firmware | No range specified | — |
| philips intellivue_np90_firmware | No range specified | — |
| philips intellivue_mx700_firmware | No range specified | — |
| philips intellivue_mx800_firmware | No range specified | — |
| philips intellivue_mx400_firmware | No range specified | — |
| philips intellivue_mx450_firmware | No range specified | — |
| philips intellivue_mx500_firmware | No range specified | — |
| philips intellivue_mx550_firmware | No range specified | — |
| philips intellivue_x3_firmware | No range specified | — |
| philips intellivue_mx100_firmware | No range specified | — |
| philips avalon_fetal\/maternal_monitors_fm20_firmware | No range specified | — |
| philips avalon_fetal\/maternal_monitors_fm30_firmware | No range specified | — |
| philips avalon_fetal\/maternal_monitors_fm40_firmware | No range specified | — |
| philips avalon_fetal\/maternal_monitors_fm50_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.