Improper input validation in ICS-CERT GE PACSystems RX3i CPE305/310 version 9.20 and…
Priority LOW 39CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable.
Why it matters now
EPSS 0.03511 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ICS-CERT | GE PACSystems RX3i CPE305/310 version 9.20 and prior RX3i CPE330 version 9.21 and prior RX3i CPE 400 version 9.30 and prior PACSystems RSTi-EP CPE 100 all versionsPACSystems CPU320/CRU320 RXi all versions | GE PACSystems RX3i CPE305/310 version 9.20 and prior RX3i CPE330 version 9.21 and prior RX3i CPE 400 version 9.30 and prior PACSystems RSTi-EP CPE 100 all versionsPACSystems CPU320/CRU320 RXi all versions | — | No fix listed | CNA |
- GE PACSystems RX3i CPE305/310 version 9.20 and prior RX3i CPE330 version 9.21 and prior RX3i CPE 400 version 9.30 and prior PACSystems RSTi-EP CPE 100 all versionsPACSystems CPU320/CRU320 RXi all versions VendorICS-CERT Affected GE PACSystems RX3i CPE305/310 version 9.20 and prior RX3i CPE330 version 9.21 and prior RX3i CPE 400 version 9.30 and prior PACSystems RSTi-EP CPE 100 all versionsPACSystems CPU320/CRU320 RXi all versions Fixed in — No fix listed CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ge:pacsystems_rx3i_cpe305_firmware:*:*:*:*:*:*:*:* | up to 9.20 | Vulnerable | GE |
| cpe:2.3:h:ge:pacsystems_rx3i_cpe305:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:pacsystems_rx3i_cpe310_firmware:*:*:*:*:*:*:*:* | up to 9.20 | Vulnerable | GE |
| cpe:2.3:h:ge:pacsystems_rx3i_cpe310:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:rx3i_cpe330_firmware:*:*:*:*:*:*:*:* | up to 9.21 | Vulnerable | GE |
| cpe:2.3:h:ge:rx3i_cpe330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:rx3i_cpe_400_firmware:*:*:*:*:*:*:*:* | up to 9.30 | Vulnerable | GE |
| cpe:2.3:h:ge:rx3i_cpe_400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:pacsystems_rsti-ep_cpe_100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | GE |
| cpe:2.3:h:ge:pacsystems_rsti-ep_cpe_100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
- cpe:2.3:o:ge:pacsystems_rx3i_cpe305_firmware:*:*:*:*:*:*:*:* Versions up to 9.20 Vulnerable ·GE
- cpe:2.3:h:ge:pacsystems_rx3i_cpe305:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:pacsystems_rx3i_cpe310_firmware:*:*:*:*:*:*:*:* Versions up to 9.20 Vulnerable ·GE
- cpe:2.3:h:ge:pacsystems_rx3i_cpe310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:rx3i_cpe330_firmware:*:*:*:*:*:*:*:* Versions up to 9.21 Vulnerable ·GE
- cpe:2.3:h:ge:rx3i_cpe330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:rx3i_cpe_400_firmware:*:*:*:*:*:*:*:* Versions up to 9.30 Vulnerable ·GE
- cpe:2.3:h:ge:rx3i_cpe_400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:pacsystems_rsti-ep_cpe_100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·GE
- cpe:2.3:h:ge:pacsystems_rsti-ep_cpe_100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ge:pacsystems_cpu320_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | GE |
| cpe:2.3:h:ge:pacsystems_cpu320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:pacsystems_cru320_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | GE |
| cpe:2.3:h:ge:pacsystems_cru320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:pacsystems_rxi_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | GE |
| cpe:2.3:h:ge:pacsystems_rxi:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
- cpe:2.3:o:ge:pacsystems_cpu320_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·GE
- cpe:2.3:h:ge:pacsystems_cpu320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:pacsystems_cru320_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·GE
- cpe:2.3:h:ge:pacsystems_cru320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:pacsystems_rxi_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·GE
- cpe:2.3:h:ge:pacsystems_rxi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8867
- 2026-10-03 Alias added: GHSA-wfw6-x555-wh4g
References
Sources
- CVE-2018-8867 · CVE Program
- CVE-2018-8867 · NVD
- FIRST EPSS
- GHSA-wfw6-x555-wh4g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences