CVE-2019-10959

Опубликовано: 13 июн. 2019

Источник: nvd

CVSS3: 10

CVSS2: 7.5

EPSS Низкий

Описание

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.

Ссылки

http://www.securityfocus.com/bid/108765
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01
Mitigation
Third Party Advisory
US Government Resource
https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/alaris-gateway-workstation-unauthorized-firmware
Vendor Advisory
http://www.securityfocus.com/bid/108765
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01
Mitigation
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:10:*:*:*:*:*:*

cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:11:*:*:*:*:*:*

cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.2:15:*:*:*:*:*:*

cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.3.0:14:*:*:*:*:*:*

cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.3.1:13:*:*:*:*:*:*

cpe:2.3:h:bd:alaris_gateway_workstation:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:bd:alaris_gs_syringe_pump_firmware:*:*:*:*:*:*:*:*

Версия до 2.3.6 (включая)

cpe:2.3:h:bd:alaris_gs_syringe_pump:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:bd:alaris_gh_syringe_pump_firmware:*:*:*:*:*:*:*:*

Версия до 2.3.6 (включая)

cpe:2.3:h:bd:alaris_gh_syringe_pump:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:bd:alaris_cc_syringe_pump_firmware:*:*:*:*:*:*:*:*

Версия до 2.3.6 (включая)

cpe:2.3:h:bd:alaris_cc_syringe_pump:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:bd:alaris_tiva_syringe_pump_firmware:*:*:*:*:*:*:*:*

Версия до 2.3.6 (включая)

cpe:2.3:h:bd:alaris_tiva_syringe_pump:-:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01062

Низкий

10 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-7v5w-xv9f-c729

CVSS3: 10

github

больше 3 лет назад

EPSS

Процентиль: 77%

0.01062

Низкий

10 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-434