#VU13122 Improper authentication in MDS PulseNET Enterprise and GE MDS PulseNET - CVE-2018-10611
Published: May 31, 2018 / Updated: June 1, 2018
Vulnerability identifier: #VU13122
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-10611
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
MDS PulseNET Enterprise
GE MDS PulseNET
MDS PulseNET Enterprise
GE MDS PulseNET
Software vendor:
GE
GE
Description
The vulnerability allows a remote attacker to bypass authentication on the target system.
The vulnerability exists due to an error in Java Remote Method Invocation (RMI) input port. A remote unauthenticated attacker can bypass authentication and launch applications to support remote code execution through Web Services.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.