CVEvulnerability
CVE-2018-18630
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-09-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-732
Description
A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code.
Affected configurations
• mckesson horizon cardiology firmware (>= 12.0 <= 12.2)
• mckesson horizon cardiology firmware 11.0
• mckesson cardiology firmware 13.0
• mckesson cardiology firmware 14.0
• changehealthcare cardiology firmware 14.1.0
Related
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/ Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsma-19-241-01 Third Party Advisory, US Government Resource
- https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/ Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsma-19-241-01 Third Party Advisory, US Government Resource