Lucene search

IcscertCVE-2015-3965

HistoryMar 23, 2019 - 8:29 p.m.

CVE-2015-3965

2019-03-2320:29:00

CWE-264

icscert

web.nvd.nist.gov

hospira

symbiq

infusion system

cve-2015-3965

remote

authenticated

unanticipated operations

elevated privileges

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.002

Percentile

58.9%

JSON

Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger “unanticipated operations” by leveraging “elevated privileges” for an unspecified call to an incorrectly exposed function.

Affected configurations

Nvd

Node

pfizersymbiq_infusion_system_firmwareRange≤3.13

AND

pfizersymbiq_infusion_systemMatch-

VendorProductVersionCPE
pfizersymbiq_infusion_system_firmware*cpe:2.3:o:pfizer:symbiq_infusion_system_firmware:*:*:*:*:*:*:*:*
pfizersymbiq_infusion_system-cpe:2.3:h:pfizer:symbiq_infusion_system:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pfizer	symbiq_infusion_system_firmware	*	cpe:2.3:o:pfizer:symbiq_infusion_system_firmware::::::::
pfizer	symbiq_infusion_system	-	cpe:2.3:h:pfizer:symbiq_infusion_system:-:::::::*

CNA Affected

[
  {
    "product": "Symbiq Infusion System",
    "vendor": "Hospira",
    "versions": [
      {
        "status": "affected",
        "version": "3.13 and earlier"
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSA-15-174-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.002

Percentile

58.9%

JSON

Related for CVE-2015-3965