critical10.0
CVE-2015-3459
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote a…
Impact
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hospira | Lifecare Pcainfusion Firmware | through 5.0 |
| Hospira | Lifecare Pca3 | All versions |
| Hospira | Lifecare Pca5 | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://hextechsecurity.com/?p=123
- http://imgur.com/CEAnZjj
- http://imgur.com/JHiWSqd
- http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
- http://www.securityfocus.com/bid/74414
- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
- https://twitter.com/dyngnosis/status/592671049487142913
- https://twitter.com/dyngnosis/status/592743461977219072
- http://hextechsecurity.com/?p=123
- http://imgur.com/CEAnZjj
- http://imgur.com/JHiWSqd
- http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
- http://www.securityfocus.com/bid/74414
- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
- https://twitter.com/dyngnosis/status/592671049487142913
- https://twitter.com/dyngnosis/status/592743461977219072