CVE-2018-10601: Philips Avalon Fetal/maternal Monitors FM20 Firmware

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.

Affected products

• Philips Avalon Fetal/maternal Monitors FM20 Firmware: affected versions not specified
• Philips Avalon Fetal/maternal Monitors FM30 Firmware: affected versions not specified
• Philips Avalon Fetal/maternal Monitors FM40 Firmware: affected versions not specified
• Philips Avalon Fetal/maternal Monitors FM50 Firmware: affected versions not specified
• Philips Intellivue MP2 Firmware: affected versions not specified
• Philips Intellivue MP30 Firmware: affected versions not specified
• Philips Intellivue MP50 Firmware: affected versions not specified
• Philips Intellivue MP70 Firmware: affected versions not specified
• Philips Intellivue MX100 Firmware: affected versions not specified
• Philips Intellivue MX400 Firmware: affected versions not specified
• Philips Intellivue MX450 Firmware: affected versions not specified
• Philips Intellivue MX500 Firmware: affected versions not specified
• Philips Intellivue MX550 Firmware: affected versions not specified
• Philips Intellivue MX700 Firmware: affected versions not specified
• Philips Intellivue MX800 Firmware: affected versions not specified
• Philips Intellivue NP90 Firmware: affected versions not specified
• Philips Intellivue x2 Firmware: affected versions not specified
• Philips Intellivue x3 Firmware: affected versions not specified

Published 2018-06-05. Last modified 2026-06-17.