CVE-2015-3459

Опубликовано: 29 апр. 2015

Источник: nvd

CVSS2: 10

EPSS Средний

Описание

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.

Ссылки

http://hextechsecurity.com/?p=123
Broken Link
http://imgur.com/CEAnZjj
Not Applicable
http://imgur.com/JHiWSqd
Not Applicable
http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/74414
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
Third Party Advisory
US Government Resource
https://twitter.com/dyngnosis/status/592671049487142913
Press/Media Coverage
https://twitter.com/dyngnosis/status/592743461977219072
Press/Media Coverage
http://hextechsecurity.com/?p=123
Broken Link
http://imgur.com/CEAnZjj
Not Applicable
http://imgur.com/JHiWSqd
Not Applicable
http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/74414
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
Third Party Advisory
US Government Resource
https://twitter.com/dyngnosis/status/592671049487142913
Press/Media Coverage
https://twitter.com/dyngnosis/status/592743461977219072
Press/Media Coverage

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:hospira:lifecare_pcainfusion_firmware:*:*:*:*:*:*:*:*

Версия до 5.0 (включая)

Одно из

cpe:2.3:h:hospira:lifecare_pca3:-:*:*:*:*:*:*:*

cpe:2.3:h:hospira:lifecare_pca5:-:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.17736

Средний

10 Critical

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-cc9x-rch9-9fff

github

больше 3 лет назад

BDU:2015-10323

fstec

почти 11 лет назад

Уязвимость микропрограммного обеспечения медицинского аппарата Hospira Lifecare PCA, позволяющая нарушителю получить контроль над устройством