« Volver al listado

CVE-2018-18630

Estado: ModificadaAlta (7.8)—

A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Changehealthcare — Cardiology FirmwareMckesson — Cardiology FirmwareMckesson — Horizon Cardiology Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-18630",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-06T17:15:11.183",
  "references": [
    {
      "url": "https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsma-19-241-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsma-19-241-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en producto McKesson Cardiology versiones 13.x y 14.x. Permisos de archivos no seguros en la instalación predeterminada pueden permitir a un atacante con acceso al sistema local ejecutar código arbitrario no autorizado."
    }
  ],
  "lastModified": "2026-06-17T01:47:36.447",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mckesson:horizon_cardiology_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A821C13B-5C49-45F6-A627-A002B4196708",
              "versionEndIncluding": "12.2",
              "versionStartIncluding": "12.0"
            },
            {
              "criteria": "cpe:2.3:o:mckesson:horizon_cardiology_firmware:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "070A853B-9367-49CA-8323-4F3179F91E97"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mckesson:horizon_cardiology:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "12B71733-3536-4393-8699-5224FA4BBCBB"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mckesson:cardiology_firmware:13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93A43EC6-75AA-41D5-9147-C51A08493D9C"
            },
            {
              "criteria": "cpe:2.3:o:mckesson:cardiology_firmware:14.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11A6730B-A685-4B40-AB12-0EC2ABE6D657"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mckesson:cardiology:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "95517334-C76C-47F2-A979-40D046DBF07F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:changehealthcare:cardiology_firmware:14.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "887AC5DC-F002-47A2-A399-6C18F59A3381"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:changehealthcare:cardiology:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5DBC82FA-FC4B-4C5E-8BCD-60D353B37E22"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}