PT-2015-3803 · Hospira · Hospira Lifecare Pca Infusion System

Published 2015-07-06 · Updated 2015-07-08 · CVE-2014-5406

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions prior to 7.0

Description The issue concerns the lack of validation of network traffic related to certain system updates or changes, allowing remote attackers to modify settings or medication data. This can be achieved via packets on various ports, including TELNET, HTTP, HTTPS, or UPNP.

Recommendations For versions prior to 7.0, update to version 7.0 or later to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2014-5406

Affected Products

Hospira Lifecare Pca Infusion System

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-5406 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-125-01.json · Note
• https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities · Note
• https://cisa.gov/news-events/ics-advisories/icsa-15-125-01 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 · Note
• http://fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm · Note