Code injection

Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service forced manual reboot via a flood of TCP packets...

CVE-2014-5406

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

CVE-2015-3957

CVE-2015-3957 applies to Hospira LifeCare PCA Infusion System prior to v7.0, where private keys and certificates are stored on the device. The public-facing details in the connected ICS/NIST sources describe a stack-based buffer overflow risk and related UI/network exposure in older LifeCare PCA ...

CVE-2015-3955

Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2014-5406

Hospira LifeCare PCA Infusion System prior to version 7.0 is affected by CVE-2014-5406. The device’s network-facing components (TELNET, HTTP/HTTPS, UPNP) do not validate or restrict incoming traffic, enabling an unauthenticated remote attacker to modify drug libraries, software updates, or pump c...

CVE-2014-5406 Hospira LifeCare PCA Infusion System

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

CVE-2015-3958

CVE-2015-3958 affects Hospira LifeCare PCA Infusion System (Version 5.0 and earlier). The issue enables remote denial-of-service via a flood of TCP packets, forcing manual reboot. Impact is tied to vulnerable AppWeb/network services; exploitation details are discussed in ICS-CERT/NVD entries. Mit...

CVE-2015-3958

Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service forced manual reboot via a flood of TCP packets...

CVE-2015-1011

Hospira LifeCare PCA Infusion System (Version 5.0 and earlier) is affected by multiple vulnerabilities, notably hardcoded credentials and insecure data handling. Technical details from ICS-CERT/NVD describe improper authorization (CWE-285) that could allow unauthenticated users root access and in...

PT-2015-6357

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions 5.0 and earlier Description The issue allows remote attackers to cause a denial of service, resulting in a forced manual reboot, via a flood of TCP packets. Recommendations For versions 5.0 and...

PT-2015-1621

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions prior to 7.0 Description The issue is related to the lack of protection for service data in the device's software, which can be exploited by a remote attacker to gain access to the device. Hardcode...

PT-2015-3803

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions prior to 7.0 Description The issue concerns the lack of validation of network traffic related to certain system updates or changes, allowing remote attackers to modify settings or medication data...

PT-2015-1627

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions prior to 7.0 Description The issue is related to errors in managing registration data in the software of the medical device. It may allow a local attacker to impact the security of protected...

CVE-2015-3958: Undefined Security Weakness

Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service forced manual reboot via a flood of TCP packets...

PT-2015-3088

Name of the Vulnerable Software and Affected Versions Hospira LifeCare PCA Infusion System versions 5.0 and earlier Description The issue is caused by a stack-based buffer overflow, allowing remote attackers to execute arbitrary code via unspecified vectors. This could potentially enable a remote...

CVE-2015-1011: Exposure of Sensitive Information to an Unauthorized Actor

Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-3955: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2014-5406: Insufficient Verification of Data Authenticity

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

CVE-2015-3957: Undefined Security Weakness

Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors...

Multiple Hospira Product Security Bypass Vulnerabilities

The Hospira Plum A+ Infusion System, Plum A+3 Infusion System and Symbiq Infusion System are all intelligent infusion systems from Hospira. A security bypass vulnerability exists in multiple Hospira products. An attacker could exploit the vulnerability to bypass security restrictions and perform...