CVE-2018-18630A vulnerability was found in McKesson Cardiology product 13.x and 14.x.
Updated under an hour ago ()
Does this affect you?
It affects mckesson horizon_cardiology_firmware and 2 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.33%, higher than 24% of scored CVEs.
Do this next
Free account, 1 product
A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code.
- CVSS
- 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.33% (percentile 24)
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Aug 5, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
mckesson horizon_cardiology_firmware mckesson:horizon_cardiology_firmware | from 12.0 through 12.2; 11.0 | NVD |
mckesson cardiology_firmware mckesson:cardiology_firmware | 13.0; 14.0 | NVD |
changehealthcare cardiology_firmware changehealthcare:cardiology_firmware | 14.1.0 | NVD |
References
- https://www.us-cert.gov/ics/advisories/icsma-19-241-01x-refsource-misc, third-party-advisory, us-government-resource
- https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/x-refsource-misc, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.