CVE-2018-10624

lowPriorität · verfolgen · 26EPSS 0.009 · 59. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.88% (59th) EPSS

CVSS 3.3 · low

Is it mine?

8 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-28

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenPeerVue Web Servercisa_csaf_ot
Change Healthcare has been very responsive and aggressive in their efforts to mitigate the issue and released a patch to remediate the reported vulnerability. Users should contact the Change Healthcare Supportteam for information regarding the patch.
MitigationBCPro (BCM)cisa_csaf_ot
This issue was remediated in Metasys v8.1 (April, 2016). Users should upgrade to the latest product version (9.0). For Metasys information, contact your Metasys field service/sales representative.
MitigationMetasys systemcisa_csaf_ot
This issue was remediated in Metasys v8.1 (April, 2016). Users should upgrade to the latest product version (9.0). For Metasys information, contact your Metasys field service/sales representative.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.3–6.5

v2.03.3lowAV:A/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 6.5 · Auswirkung 2.9

v3.06.5mediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.04.3mediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.14.3mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ics-cert@hq.dhs.gov USAusnutzbarkeit 2.8 · Auswirkung 1.4

v3.14mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-388USprimärCWE-209USCWE-209US

betroffene Produkte (8)

Betroffene Produkte und Versionsbereiche.

PeerVue Web Server: all versions up to 7.6.2alle Versionencisa_csaf_otUS
Change Healthcare PeerVue Web Server< 7.6.2cisa_csaf_otUS
Johnson Controls Inc BCPro (BCM)< 3.0.2cisa_csaf_otUS
Johnson Controls Inc Metasys system≤ 8.0cisa_csaf_otUS
Johnson Controls BCPro (BCM)0 → 3.0.2enisa_euvdEU
Johnson Controls Metasys System≤ 0 ≤8.0enisa_euvdEU
johnsoncontrols bcpro< 3.0.2nvdUScpe:2.3:a:johnsoncontrols:bcpro:*:*:*:*:*:*:*:*
johnsoncontrols metasys system≤ 8.0nvdUScpe:2.3:a:johnsoncontrols:metasys_system:*:*:*:*:*:*:*:*

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-18-212-02Johnson Controls Metasys and BCPro2018-07-31icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to obtain technical information about the Metasys or BCPro server, allowing an attacker to target a system for attack.
ICSMA-18-277-02Change Healthcare PeerVue Web Server2018-10-04icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to obtain technical information about the PeerVue Web Server, allowing an attacker to target a system for attack.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2018-08-01geändert 2026-09-10

verwandt (148)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2018-0155US	high8.6OT kritisch	7.74% (95th)	KEV	2018-03-28
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow…
CVE-2018-1002105US	critical9.8	87.0% (100th)	Exploit	2018-12-05
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafte…
CVE-2025-31650US	high7.5	61.3% (99th)	Exploit	2025-04-28
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request whic…
CVE-2017-3737US	medium5.9OT hoch	78.7% (100th)	—	2017-12-07
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into th…
CVE-2007-1534US	high9.3	13.4% (96th)	—	2007-03-20
DFSR.exe in Windows Meeting Space in Microsoft Windows Vista remains available for remote connections on TCP port 5722 for 2 minutes after Windows Meeting Space is closed, which al…

+143 weitere

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

http://www.johnsoncontrols.com/Patchcnnvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02 cnnvd
https://www.securityfocus.com/bid/104937 cnnvd
http://www.securityfocus.com/bid/104937 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02 enisa_euvd
http://www.securityfocus.com/bid/104937Third Party AdvisoryVDB Entrynvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02MitigationThird Party AdvisoryUS Government Resourcenvd
https://www.cisa.gov/news-events/ics-advisories/icsa-18-212-02 nvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan