CVE-2014-5406

Опубликовано: 06 июл. 2015

Источник: nvd

CVSS2: 7.6

CVSS2: 9.3

EPSS Низкий

Описание

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port. NOTE: this issue might overlap CVE-2015-3459.

Ссылки

http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
Third Party Advisory
US Government Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-125-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-15-125-01
https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/
http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
Third Party Advisory
US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
Third Party Advisory
US Government Resource
https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:hospira:lifecare_pcainfusion_firmware:*:*:*:*:*:*:*:*

Версия до 5.0 (включая)

Одно из

cpe:2.3:h:hospira:lifecare_pca3:-:*:*:*:*:*:*:*

cpe:2.3:h:hospira:lifecare_pca5:-:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.0055

Низкий

7.6 High

CVSS2

9.3 Critical

CVSS2

Дефекты

CWE-345

Связанные уязвимости

GHSA-vxf4-qh89-w2r6

github

больше 3 лет назад

EPSS

Процентиль: 67%

0.0055

Низкий

7.6 High

CVSS2

9.3 Critical

CVSS2

Дефекты

CWE-345