CVE-2018-8867

HIGH

GE PACSystems RX3i/RSTi-EP CPE Denial of Service via Crafted Packets

Title source: llm

Description

In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/104241

Mitigation, Third Party Advisory, US Government Resource x_refsource_misc

https://ics-cert.us-cert.gov/advisories/ICSA-18-137-01

Scores

CVSS v3 7.5

EPSS 0.0347

EPSS Percentile 87.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-20

Status published

Products (8)

ge/pacsystems_cpu320_firmware

ge/pacsystems_cru320_firmware

ge/pacsystems_rsti-ep_cpe_100_firmware

ge/pacsystems_rx3i_cpe305_firmware < 9.20

ge/pacsystems_rx3i_cpe310_firmware < 9.20

ge/pacsystems_rxi_firmware

ge/rx3i_cpe330_firmware < 9.21

ge/rx3i_cpe_400_firmware < 9.30

Published May 18, 2018

Tracked Since Feb 18, 2026