Philips' IntelliVue Patient and Avalon Fetal Monitors
The vulnerability allows an unauthenticated attacker to access memory (write-what-where) from an attacker-chosen device address within the same subnet.CVE-2018-10597 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). The vulnerability allows an unauthenticated attacker to read memory from an attacker-chosen device address within the same subnet.CVE-2018-10599 has been assigned to this vulnerability. A CVSS v3 base score of 6.4 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L). The vulnerability exposes an echo service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.CVE-2018-10601 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H).