VulnerabilityModified
CVE-2018-10611
Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services.
CRITICAL 9.8EPSS 4.99%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.99%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 4.99% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- ge/mds pulsenet
- Source
- ics-cert@hq.dhs.gov
References
- http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1Permissions Required
- http://www.securityfocus.com/bid/104377Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02Third Party Advisory, US Government Resource
- http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1Permissions Required
- http://www.securityfocus.com/bid/104377Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.