PT-2018-9990 · Philips · Intellivue Patient Monitors Mx+3

Published 2018-06-05 · Updated 2021-05-10 · CVE-2018-10599

Positive Technologies (AI Summary)

CVSS v2.0

2.9

Low

Base vector

AV:A/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IntelliVue Patient Monitors MP Series versions Rev B-M IntelliVue Patient Monitors MX versions Rev J-M Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0, J.3 IntelliVue Patient Monitors X3/MX100 version Rev M

Description: The issue allows an unauthenticated attacker to read memory from an attacker-chosen device address within the same subnet.

Recommendations: For IntelliVue Patient Monitors MP Series versions Rev B-M, update to a version that includes the necessary security patches. For IntelliVue Patient Monitors MX versions Rev J-M, apply the recommended configuration changes to restrict access to the vulnerable component. For Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0, J.3, restrict network access to the device to minimize the risk of exploitation. For IntelliVue Patient Monitors X3/MX100 version Rev M, consider implementing additional security measures to prevent unauthorized access to the device.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-10599

Affected Products

Avalon Fetal/Maternal Monitors

Intellivue Patient Monitors Mp Series

Intellivue Patient Monitors Mx

Intellivue Patient Monitors X3/Mx100

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2018-10599 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01 · Note