PT-2015-3803 · Hospira · Hospira Lifecare Pca Infusion System

Publicado 2015-07-06 · Atualizado 2015-07-08 · CVE-2014-5406

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions prior to 7.0

Description The issue concerns the lack of validation of network traffic related to certain system updates or changes, allowing remote attackers to modify settings or medication data. This can be achieved via packets on various ports, including TELNET, HTTP, HTTPS, or UPNP.

Recommendations For versions prior to 7.0, update to version 7.0 or later to resolve the issue.

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2014-5406

Produtos afetados

Hospira Lifecare Pca Infusion System

Referências · 6

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-125-01.json · Nota
• https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities · Nota
• https://cisa.gov/news-events/ics-advisories/icsa-15-125-01 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 · Nota
• http://fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5406 · Nota de Segurança