CVE-2014-5406
HighSummary
The Hospira LifeCare PCA Infusion System before version 7.0 does not validate network traffic associated with sending a drug library, software update, or configuration change. This allows remote attackers to modify settings or medication data via packets on TELNET, HTTP, HTTPS, or UPNP ports.
Risk Assessment
Attackers can remotely change critical settings of the infusion system, potentially leading to incorrect medication dosages, posing serious risks to patients.
Recommendation
It is recommended to update the system to version 7.0 or later and implement appropriate network security measures to restrict access to TELNET, HTTP, HTTPS, and UPNP ports.
Other vulnerabilities in Hospira LifeCare PCA Infusion System
See all- CVE-2015-3958High
The Hospira LifeCare PCA Infusion System version 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (forced manual reboot) via a flood of TCP packets.
- CVE-2015-3955High
A stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier allows remote attackers to execute arbitrary code.
- CVE-2015-3459High
The communication module on the Hospira LifeCare PCA Infusion System before version 7.0 does not require authentication for root TELNET sessions, allowing remote attackers to modify the pump configuration via unspecified commands.
Original NVD description (English source)
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port. NOTE: this issue might overlap CVE-2015-3459.