Insufficiently protected credentials in ICS-CERT BeaconMedæs TotalAlert Scroll…
Priority MEDIUM 45CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-522.
Summary
In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner.
Why it matters now
EPSS 0.01283 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ICS-CERT | BeaconMedæs TotalAlert Scroll Medical Air Systems web application | All versions prior to version 4107600010.23 | — | No fix listed | CNA |
- BeaconMedæs TotalAlert Scroll Medical Air Systems web application VendorICS-CERT Affected All versions prior to version 4107600010.23 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:beaconmedaes:scroll_medical_air_systems_firmware:*:*:*:*:*:*:*:* | before 4107600010.23 | Vulnerable | Beaconmedaes |
| cpe:2.3:h:beaconmedaes:scroll_medical_air_systems:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Beaconmedaes |
- cpe:2.3:o:beaconmedaes:scroll_medical_air_systems_firmware:*:*:*:*:*:*:*:* Versions before 4107600010.23 Vulnerable ·Beaconmedaes
- cpe:2.3:h:beaconmedaes:scroll_medical_air_systems:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Beaconmedaes
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7518
- 2026-10-03 Alias added: GHSA-g3g6-pxw3-m2vj
References
More Beaconmedaes Scroll Medical Air Systems Firmware vulnerabilities
- TI-2018-05419 Insufficiently protected credentials in ICS-CERT BeaconMedaes TotalAlert Scroll Medical… CVSS 3.0CRITICAL 9.8
- TI-2018-05435 In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to… CVSS 3.0HIGH 7.5
Sources
- CVE-2018-7518 · CVE Program
- CVE-2018-7518 · NVD
- FIRST EPSS
- GHSA-g3g6-pxw3-m2vj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences