What’s Vulnerable › Vulnerabilities

CVE-2018-10601

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-05 · updated 2026-06-17
• Weakness: CWE-121

Description

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.

Affected products

• Philips Avalon Fetal/Maternal Monitors Fm20 Firmware: all versions
• Philips Avalon Fetal/Maternal Monitors Fm30 Firmware: all versions
• Philips Avalon Fetal/Maternal Monitors Fm40 Firmware: all versions
• Philips Avalon Fetal/Maternal Monitors Fm50 Firmware: all versions
• Philips Intellivue Mp2 Firmware: all versions
• Philips Intellivue Mp30 Firmware: all versions
• Philips Intellivue Mp50 Firmware: all versions
• Philips Intellivue Mp70 Firmware: all versions
• Philips Intellivue Mx100 Firmware: all versions
• Philips Intellivue Mx400 Firmware: all versions
• Philips Intellivue Mx450 Firmware: all versions
• Philips Intellivue Mx500 Firmware: all versions
• Philips Intellivue Mx550 Firmware: all versions
• Philips Intellivue Mx700 Firmware: all versions
• Philips Intellivue Mx800 Firmware: all versions
• Philips Intellivue Np90 Firmware: all versions
• Philips Intellivue X2 Firmware: all versions
• Philips Intellivue X3 Firmware: all versions

References

• https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01

Get alerted when CVE-2018-10601 or the next vulnerability affects your stack