PT-2022-15659 · Bd · Bd Pyxis

Published 2022-02-11 · Updated 2022-05-11 · CVE-2022-22766

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BD Pyxis (affected versions not specified)

Description The issue involves hardcoded credentials in specific BD Pyxis products. If exploited, this could allow threat actors to gain access to the underlying file system. They could potentially exploit application files to obtain information for decrypting application credentials or to gain access to electronic protected health information (ePHI) or other sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-22766

Affected Products

Bd Pyxis

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-22766 · Security Note
• https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products---hardcoded-credentials · Vendor Advisory
• https://t.me/cibsecurity/37348 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsma-22-062-01 · Note
• https://t.me/cvenotify/26689 · Telegram Post