CVE-2015-3956

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host...

CVE-2015-3956

The CVE-2015-3956 family affects Hospira Plum A+ Infusion System (version 13.4 and earlier), Plum A+3 Infusion System (13.6 and earlier), and Symbiq Infusion System (3.13 and earlier). Affected devices accept drug libraries, firmware updates, pump commands, and unauthenticated configuration chang...

Design/Logic Flaw

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the pump. Hospira...

Hardcoded credentials

Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices...

CVE-2015-3953

Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices...

CVE-2015-3954

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the pump. Hospira...

CVE-2015-3952

Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices...

Authorization

Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices...

CVE-2015-3954

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the pump. Hospira...

CVE-2015-3954

Hospira Plum A+ Infusion System (versions 13.4 and earlier), Plum A+3 Infusion System (13.6 and earlier), and Symbiq Infusion System (3.13 and earlier) expose unauthenticated root privileges on Port 23/TELNET by default, allowing an unauthorized user to issue pump commands. Hospira notes Plum 360...

CVE-2015-3953

Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices...

CVE-2015-3953

CVE-2015-3953 affects Hospira Plum A+ Infusion System (versions prior to 13.4), Plum A+3 Infusion System (prior to 13.6), and Symbiq Infusion System (prior to 3.13). Root cause: hard-coded credentials allowing access via affected devices; additional risk factors include services listening on Port...

CVE-2015-3952

Summary: CVE-2015-3952 concerns information disclosure from Hospira infusion systems where wireless keys are stored in plain text. Affected products: Plum A+ Infusion System v13.4 and earlier, Plum A+3 Infusion System v13.6 and earlier, and Symbiq Infusion System v3.13 and earlier. Root cause: cl...

CVE-2015-3952

Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices...

CVE-2015-3965

Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function...

CVE-2015-3965

CVE-2015-3965 affects Hospira Symbiq Infusion System (Version 3.13 and earlier). The vulnerability arises from Exposed Dangerous Method or Function (CWE-749) that, with remote access and elevated privileges, could cause unanticipated operations on the device. Affected component is the device’s so...

CVE-2015-3965

Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function...

CVE-2018-17539

The BGP daemon bgpd in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote attackers to cause a denial of service attack via an autonomous system AS path containing 8 or more autonomous system number ASN elements...

Design/Logic Flaw

The BGP daemon bgpd in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote attackers to cause a denial of service attack via an autonomous system AS path containing 8 or more autonomous system number ASN elements...

CVE-2018-17539

The CVE-2018-17539 issue affects ZebOS/bgpd and OcNOS/bgpd, with vulnerable versions up to ZebOS 7.10.6 and OcNOS 1.3.3.145. An attacker can cause a denial of service by sending an AS path containing 8 or more ASN elements, disrupting dynamic routing as the bgpd process restarts. F5 advisory (K17...