What is the CVSS score of CVE-2018-8867?

CVE-2018-8867 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 3.5%.

Pacsystems Rx3I Cpe305 Firmware CVE-2018-8867

HIGH

Improper Input Validation (CWE-20)

2018-05-18 ics-cert@hq.dhs.gov

Information Disclosure Pacsystems Rx3I Cpe305 Firmware Pacsystems Rx3I Cpe310 Firmware Rx3I Cpe330 Firmware Rx3I Cpe 400 Firmware Pacsystems Rsti Ep Cpe 100 Firmware Pacsystems Cpu320 Firmware Pacsystems Cru320 Firmware Pacsystems Rxi Firmware

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

May 18, 2018 - 20:29 nvd

HIGH 7.5

DescriptionNVD

In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable.

AnalysisAI

In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable. Affected products include: Ge Pacsystems Rx3I Cpe305 Firmware, Ge Pacsystems Rx3I Cpe310 Firmware, Ge Rx3I Cpe330 Firmware, Ge Rx3I Cpe 400 Firmware, Ge Pacsystems Rsti-Ep Cpe 100 Firmware. Version information: version 9.20.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.