PT-2017-10082 · Becton · Alaris 8015 Point Of Care Unit

Asher Davila Loranca + 2 · Publicado 2017-02-13 · Atualizado 2022-03-03 · CVE-2016-9355

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit versions 9.5 and prior Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit version 9.7

Description An issue allows an unauthorized user with physical access to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling the device and accessing its flash memory. The device's removable flash memory stores these credentials and data in older software versions, allowing an attacker to extract them without detection.

Recommendations For version 9.5 and prior, consider implementing physical security measures to prevent unauthorized access to the device's flash memory. For version 9.7, restrict physical access to the device to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of removable flash memory in the affected devices until a patch is available.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2016-9355

Produtos afetados

Alaris 8015 Point Of Care Unit

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9355 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9355 · Aviso do Fabricante
• http://securityfocus.com/bid/96116 · Nota
• https://t.me/true_secator/2696 · Publicação no Telegram
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02 · Nota