PT-2023-15291 · Bd · Alaris Infusion Central

Published 2023-06-13 · Updated 2025-01-03 · CVE-2022-47376

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Alaris Infusion Central software versions 1.1 to 1.3.2

Description The issue concerns a recoverable password that may be present after the installation of the software. It is noted that no patient health data is stored in the database by default, although some installations may choose to store personal data.

Recommendations For Alaris Infusion Central software versions 1.1 to 1.3.2, consider changing the default password after installation to prevent potential unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-257

Related Identifiers

CVE-2022-47376

Affected Products

Alaris Infusion Central

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-47376 · Security Note
• https://bd.com/en-us/about-bd/cybersecurity/bulletin/alaris-infusion-central-recoverable-password-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47376 · Vendor Advisory
• https://t.me/cvenotify/106232 · Telegram Post
• https://t.me/cvenotify/52999 · Telegram Post