CVE-2015-1012

Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless...

CVE-2015-1012

Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless...

Stack overflow

Stack-based buffer overflow in Hospira Communication Engine CE before 1.2 in LifeCare PCA Infusion System 5.07, Plum A+ Infusion System 13.40, and Plum A+3 Infusion System 13.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via traffic on TCP port...

CVE-2015-7909

Hospira LifeCare PCA Infusion System (v5.07) and Plum A+/A+3 Infusion Systems (CE prior to v1.2) are affected by a stack-based buffer overflow in the Hospira Communication Engine (CE) exposed on TCP port 5000. The vulnerability enables a remote attacker to cause a denial of service (and potential...

The vulnerability of the microprogrammed software of the LifeCare PCA Infusion System allows a perpetrator to compromise the security of the protected information.

The vulnerability of the microprogrammed medical device LifeCare PCA Infusion System is related to errors in managing registration data. Exploiting this vulnerability could allow an intruder, operating locally, to compromise the security of protected information due to the storage of closed keys...

CVE-2015-3957

Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors...

CVE-2015-1011

Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors...

Design/Logic Flaw

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

CVE-2015-3957

Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors...

CVE-2015-3958

Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service forced manual reboot via a flood of TCP packets...

CVE-2015-1011

Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2014-5406

Hospira LifeCare PCA Infusion System prior to version 7.0 is affected by CVE-2014-5406. The device’s network-facing components (TELNET, HTTP/HTTPS, UPNP) do not validate or restrict incoming traffic, enabling an unauthenticated remote attacker to modify drug libraries, software updates, or pump c...

CVE-2014-5406 Hospira LifeCare PCA Infusion System

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

CVE-2015-3955

Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors...

Authentication flaw

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands...

CVE-2015-3459

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands...

Hospira LifeCare PCA Infusion System Vulnerabilities

OVERVIEW Independent researcher Billy Rios has identified an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in Hospira’s LifeCare PCA Infusion System, which NCCIC/ICS-CERT has been coordinating with Hospira since May 2014. This advisory is...