Dan Regalado

**Name of the Vulnerable Software and Affected Versions** VGo Robot versions 3.0.3.52164 through 3.0.3.53662 VGo Robot versions prior to 3.0.3.52164 **Description** The issue allows user accounts to execute commands outside their privileges, potentially within the scope of an admin account. If an attacker has access to VGo XAMPP Client credentials, they may be able to execute admin commands on the connected robot. **Recommendations** For VGo Robot versions 3.0.3.52164 through 3.0.3.53662, update to a version that includes a fix for this issue. For VGo Robot versions prior to 3.0.3.52164, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to admin commands on the connected robot until a patch is available. Restrict access to VGo XAMPP Client credentials to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Johnson Controls Metasys System versions 8.0 and prior BCPro (BCM) versions prior to 3.0.2 **Description** This issue results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information. **Recommendations** For Johnson Controls Metasys System versions 8.0 and prior, update to a version later than 8.0 to resolve the issue. For BCPro (BCM) versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit versions 9.5 and prior Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit version 9.7 **Description** An issue allows an unauthorized user with physical access to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling the device and accessing its flash memory. The device's removable flash memory stores these credentials and data in older software versions, allowing an attacker to extract them without detection. **Recommendations** For version 9.5 and prior, consider implementing physical security measures to prevent unauthorized access to the device's flash memory. For version 9.7, restrict physical access to the device to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of removable flash memory in the affected devices until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit versions 9.5 and prior Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit version 9.7 Becton, Dickinson and Company (BD) Alaris 8000 PC unit **Description** An issue allows an unauthorized user with physical access to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling the PC unit and accessing the device's flash memory. The affected devices store sensitive data on internal flash memory, requiring special tools to extract and increasing the likelihood of detection if carried out in a healthcare facility. **Recommendations** For Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit versions 9.5 and prior, consider implementing additional physical security measures to prevent unauthorized access to the device. For Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit version 9.7, restrict access to the device's internal components to minimize the risk of exploitation. For Becton, Dickinson and Company (BD) Alaris 8000 PC unit, ensure that the device is stored in a secure location when not in use to prevent unauthorized physical access.