PT-2020-15992 · Bd · Alaris Systems Manager+1

Published 2020-11-13 · Updated 2022-03-03 · CVE-2020-25165

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BD Alaris PC Unit, Model 8015, versions 9.33.1 and earlier BD Alaris Systems Manager, versions 4.33 and earlier

Description The affected products are vulnerable to a network session authentication issue within the authentication process. If exploited, an attacker could perform a denial-of-service attack by modifying the configuration headers of data in transit. This could lead to a drop in the wireless capability, resulting in manual operation.

Recommendations For BD Alaris PC Unit, Model 8015, versions 9.33.1 and earlier: update to a version later than 9.33.1 to resolve the issue. For BD Alaris Systems Manager, versions 4.33 and earlier: update to a version later than 4.33 to resolve the issue. As a temporary workaround, consider restricting access to the authentication process between the BD Alaris PC Unit and the BD Alaris Systems Manager to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-25165

Affected Products

Bd Alaris Pc Unit

Alaris Systems Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-25165 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25165 · Vendor Advisory
• https://t.me/true_secator/2696 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsma-20-317-01 · Note
• https://t.me/cibsecurity/16291 · Telegram Post