PT-2015-1287 · Hospira · Hospira Lifecare Pca Infusion System

Billy Rios · Published 2015-04-29 · Updated 2017-01-03 · CVE-2015-3459

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions prior to 7.0

Description The issue concerns the lack of authentication for Telnet sessions on the communication module of the affected device. This allows a remote attacker to gain control over the device by exploiting the absence of authentication on port 23, specifically for root Telnet sessions. The attacker can modify the pump configuration using unspecified commands.

Recommendations For versions prior to 7.0, consider disabling the Telnet protocol or restricting access to port 23 until a patch is available. As a temporary workaround, limit network access to the device to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-10323

CVE-2015-3459

Affected Products

Hospira Lifecare Pca Infusion System

References · 11

• https://bdu.fstec.ru/vul/2015-10323 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3459 · Security Note
• https://twitter.com/dyngnosis/status/592743461977219072 · Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3459 · Note
• https://twitter.com/dyngnosis/status/592671049487142913 · Note
• http://securityfocus.com/bid/74414 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 · Note
• http://hextechsecurity.com/?p=123 · Note
• http://imgur.com/JHiWSqd · Note
• http://fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm · Note
• http://imgur.com/CEAnZjj · Note