PT-2017-10082 · Becton · Alaris 8015 Point Of Care Unit

Asher Davila Loranca + 2 · Published 2017-02-13 · Updated 2022-03-03 · CVE-2016-9355

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit versions 9.5 and prior Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit version 9.7

Description An issue allows an unauthorized user with physical access to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling the device and accessing its flash memory. The device's removable flash memory stores these credentials and data in older software versions, allowing an attacker to extract them without detection.

Recommendations For version 9.5 and prior, consider implementing physical security measures to prevent unauthorized access to the device's flash memory. For version 9.7, restrict physical access to the device to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of removable flash memory in the affected devices until a patch is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2016-9355

Affected Products

Alaris 8015 Point Of Care Unit

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9355 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9355 · Vendor Advisory
• http://securityfocus.com/bid/96116 · Note
• https://t.me/true_secator/2696 · Telegram Post
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02 · Note