CVE-2014-5406 Hospira LifeCare PCA Infusion System

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

CVE-2015-3958

Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service forced manual reboot via a flood of TCP packets...

CVE-2014-5406

Hospira LifeCare PCA Infusion System prior to version 7.0 is affected by CVE-2014-5406. The device’s network-facing components (TELNET, HTTP/HTTPS, UPNP) do not validate or restrict incoming traffic, enabling an unauthenticated remote attacker to modify drug libraries, software updates, or pump c...

CVE-2015-3957

CVE-2015-3957 applies to Hospira LifeCare PCA Infusion System prior to v7.0, where private keys and certificates are stored on the device. The public-facing details in the connected ICS/NIST sources describe a stack-based buffer overflow risk and related UI/network exposure in older LifeCare PCA ...

CVE-2015-3955

Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-1011

Hospira LifeCare PCA Infusion System (Version 5.0 and earlier) is affected by multiple vulnerabilities, notably hardcoded credentials and insecure data handling. Technical details from ICS-CERT/NVD describe improper authorization (CWE-285) that could allow unauthenticated users root access and in...

CVE-2015-3958

CVE-2015-3958 affects Hospira LifeCare PCA Infusion System (Version 5.0 and earlier). The issue enables remote denial-of-service via a flood of TCP packets, forcing manual reboot. Impact is tied to vulnerable AppWeb/network services; exploitation details are discussed in ICS-CERT/NVD entries. Mit...

Multiple Hospira Product Security Bypass Vulnerabilities

The Hospira Plum A+ Infusion System, Plum A+3 Infusion System and Symbiq Infusion System are all intelligent infusion systems from Hospira. A security bypass vulnerability exists in multiple Hospira products. An attacker could exploit the vulnerability to bypass security restrictions and perform...

Stack Buffer Overflow Vulnerability in Multiple Hospira Products

The Hospira Plum A+ Infusion System, Plum A+3 Infusion System and Symbiq Infusion System are all intelligent infusion systems from Hospira. A stack buffer overflow vulnerability exists in multiple Hospira products due to the program failing to perform proper boundary checks on user-submitted inpu...

Hardcoded Password Security Bypass Vulnerability in Multiple Hospira Products

The Hospira Plum A+ Infusion System, Plum A+3 Infusion System and Symbiq Infusion System are all intelligent infusion systems from Hospira. A security bypass vulnerability exists in multiple Hospira products. An attacker could exploit this vulnerability to bypass security restrictions and gain...

Local Security Bypass Vulnerability in Multiple Hospira Products

The Hospira Plum A+ Infusion System, Plum A+3 Infusion System and Symbiq Infusion System are all intelligent infusion systems from Hospira. A local security bypass vulnerability exists in multiple Hospira products. A local attacker could exploit this vulnerability to bypass security restrictions...

Authentication Bypass Vulnerability in Multiple Hospira Products

The Hospira Plum A+ Infusion System, Plum A+3 Infusion System and Symbiq Infusion System are all intelligent infusion systems from Hospira. An authentication bypass vulnerability exists in multiple Hospira products. An attacker could use this vulnerability to bypass the authentication mechanism a...

Hospira LifeCare PCA Infusion System Security Restriction Bypass Vulnerability

The Hospira LifeCare PCA Infusion System is an IV infusion pump that delivers medications to patients. Hospira LifeCare PCA Infusion System 5.0 and earlier versions are vulnerable to a data authenticity validation vulnerability in their implementation by uploading software updates, configuration...

CVE-2015-3459

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands...

CVE-2015-3459

Hospira LifeCare PCA Infusion System (pre-7.0) has an unauthenticated root Telnet access in the device’s communication module, allowing remote modification of pump configuration. Connected sources confirm affected products include LifeCare PCA Infusion System versions 5.0 and older, with exploita...

Baxter SIGMA Spectrum Infusion System Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 30, 2015, and is being released to the NCCIC/ICS-CERT web site. Researcher Jared Bird with Allina IS Security identified four vulnerabilities in Baxter’s SIGMA Spectrum Infusion System. Baxter has released a...

Hospira Symbiq Infusion System Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 23, 2015, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Billy Rios identified a vulnerability in Hospira’s Symbiq Infusion System, which can be exploited to remotely control th...

Hospira Plum A+ and Symbiq Infusion Systems Vulnerabilities

OVERVIEW Independent researcher Billy Rios has identified vulnerabilities in Hospira’s Plum A+ Infusion System that are similar to vulnerabilities identified in Hospira’s LifeCare PCA Infusion System discussed in advisory, ICSA-15-125-01B Hospira LifeCare PCA Infusion System Vulnerabilities...