CVE-2018-7518 Information disclosure in BeaconMedæs TotalAlert Scroll Medical Air Systems web application
An attacker with network access can retrieve default or user-defined credentials from the TotalAlert web application, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7518?
CVE-2018-7518 is a critical vulnerability in ICS-CERT BeaconMedæs TotalAlert Scroll Medical Air Systems web application, published on 24 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner.
Weakness: CWE-522
Which versions are affected by CVE-2018-7518?
It affects 1 product.
Products include Beaconmedaes Scroll Medical Air Systems Firmware.
How do I fix CVE-2018-7518?
No fix has been published for CVE-2018-7518 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7518 being exploited?
There is no known exploitation of CVE-2018-7518 in the wild and no public exploit code.
Other vulnerabilities in ICS-CERT BeaconMedæs TotalAlert Scroll Medical Air Systems web application
Sources
Also known as GHSA-g3g6-pxw3-m2vj.