CVEvulnerability
CVE-2015-3459
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-04-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.
Affected configurations
• hospira lifecare pcainfusion firmware (<= 5.0)
• hospira lifecare pca3
• hospira lifecare pca5
Related
Weakness · not in database (1)
References
- http://hextechsecurity.com/?p=123 Broken Link
- http://imgur.com/CEAnZjj Not Applicable
- http://imgur.com/JHiWSqd Not Applicable
- http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/74414 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 Third Party Advisory, US Government Resource
- https://twitter.com/dyngnosis/status/592671049487142913 Press/Media Coverage
- https://twitter.com/dyngnosis/status/592743461977219072 Press/Media Coverage
- http://hextechsecurity.com/?p=123 Broken Link
- http://imgur.com/CEAnZjj Not Applicable
- http://imgur.com/JHiWSqd Not Applicable
- http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/74414 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 Third Party Advisory, US Government Resource
- https://twitter.com/dyngnosis/status/592671049487142913 Press/Media Coverage
- https://twitter.com/dyngnosis/status/592743461977219072 Press/Media Coverage