CVE-2017-12718 Memory corruption in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
A buffer overflow in a third-party component allows remote code execution on Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pumps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12718?
CVE-2017-12718 is a high-severity memory corruption vulnerability in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, published on 15 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump does not verify input buffer size prior to copying, leading to a buffer overflow, allowing remote code execution on the target device. The pump receives the potentially malicious input infrequently and under certain conditions, increasing the difficulty of exploitation.
Which versions are affected by CVE-2017-12718?
It affects 1 product.
Products include Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump.
How do I fix CVE-2017-12718?
No fix has been published for CVE-2017-12718 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-12718 being exploited?
There is no known exploitation of CVE-2017-12718 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
- CVE-2017-12720 Missing authorization in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
- CVE-2017-12724 Hardcoded credentials in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
- CVE-2017-12726 Hardcoded credentials in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
- CVE-2017-12721 Weak cryptography in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
- CVE-2017-12725 Hardcoded credentials in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
Sources
Also known as GHSA-84pw-5frw-ww2p.