PT-2018-5446 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump
Published
2018-02-15
·
Updated
2019-10-09
·
CVE-2017-12718
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6
Description:
A buffer overflow issue was discovered in the pump due to a third-party component not verifying input buffer size prior to copying, leading to a buffer overflow and allowing remote code execution on the target device. The pump receives potentially malicious input infrequently and under certain conditions, increasing the difficulty of exploitation.
Recommendations:
For version 1.1, update the third-party component to a version that verifies input buffer size prior to copying.
For version 1.5, update the third-party component to a version that verifies input buffer size prior to copying.
For version 1.6, update the third-party component to a version that verifies input buffer size prior to copying.
Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Medfusion 4000 Wireless Syringe Infusion Pump