← Vulnerability feed

Vulnerability record · CVE-2018-10611 · published 4 June 2018

CVE-2018-10611: Ge mds pulsenet improper authentication vulnerability

Ge · Mds Pulsenet

Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services.

9.8 CVSS 3.0 Critical EPSS 5.0% · top 8.1% CWE-287 · Improper authentication
9.8CVSS 3.0 base score, v2 7.5
5.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1 Permissions Required
http://www.securityfocus.com/bid/104377 Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02 Third Party AdvisoryUS Government Resource
http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1 Permissions Required
http://www.securityfocus.com/bid/104377 Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02 Third Party AdvisoryUS Government Resource

Track CVE-2018-10611 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2015-6459Ge mds pulsenet path traversal vulnerabilityAbsolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise be…EPSS 3.1%9.0CVE-2015-6456Ge mds pulsenet vulnerabilityGE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attacke…EPSS 3.8%8.1CVE-2018-10615Ge mds pulsenet relative path traversal vulnerabilityDirectory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host pl…EPSS 2.6%7.5CVE-2018-10613Ge mds pulsenet xml external entity (xxe) vulnerabilityMultiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS Pulse…EPSS 18%7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 9.8%analysed9.8CVE-2026-82329JFrog Artifactory improper authentication allows admin takeoverJFrog Artifactory contains an improper authentication weakness (CWE-287) that, under default configuration, may let an unauthenticated attacker with …KEVEPSS 14%analysed8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed10.0CVE-2026-49869Kestra OSS auth bypass via path suffix match enables RCEKestra OSS AuthenticationFilter whitelists the public config endpoint using request.getPath().endsWith("/configs"), a suffix match instead of an exac…KEVEPSS 2.1%analysed

Source: NIST National Vulnerability Database (record CVE-2018-10611), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.