CVE-2018-7526 Missing authorization in n/a

High 7.5 Published 24 May 2018 Updated 5 Aug 2024

An unauthenticated attacker can access sensitive application information by accessing a specific URL in BeaconMedaes Scroll Medical Air Systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-7526?

CVE-2018-7526 is a high-severity missing authorization vulnerability in n/a, published on 24 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access information in the application without authenticating.

Weakness: CWE-425

Which versions are affected by CVE-2018-7526?

It affects 1 product.

Products include Beaconmedaes Scroll Medical Air Systems Firmware.

How do I fix CVE-2018-7526?

No fix has been published for CVE-2018-7526 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-7526 being exploited?

There is no known exploitation of CVE-2018-7526 in the wild and no public exploit code.

Sources

Also known as GHSA-hmhr-hg65-m689.