CVE-2018-18630

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.33%

Published

Sep 6, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-732

Affected Products (8)

mckesson · horizon_cardiology_firmwarevulnerable

mckesson · horizon_cardiology

mckesson · cardiology_firmwarevulnerable

mckesson · cardiology

changehealthcare · cardiology_firmwarevulnerable

changehealthcare · cardiology

References (4)

https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/

Third Party Advisory

https://www.us-cert.gov/ics/advisories/icsma-19-241-01

Third Party AdvisoryUS Government Resource

https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/

Third Party Advisory

https://www.us-cert.gov/ics/advisories/icsma-19-241-01

Third Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs