CVE-2015-3459
HighSummary
The communication module on the Hospira LifeCare PCA Infusion System before version 7.0 does not require authentication for root TELNET sessions, allowing remote attackers to modify the pump configuration via unspecified commands.
Risk Assessment
The lack of authentication for TELNET sessions poses a serious security risk, enabling attackers to remotely take control of the device and make unauthorized changes.
Recommendation
It is recommended to update the system to version 7.0 or later and implement additional security measures, such as restricting access to TELNET sessions.
Other vulnerabilities in Hospira LifeCare PCA Infusion System
See all- CVE-2015-3958High
The Hospira LifeCare PCA Infusion System version 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (forced manual reboot) via a flood of TCP packets.
- CVE-2015-3955High
A stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier allows remote attackers to execute arbitrary code.
- CVE-2014-5406High
The Hospira LifeCare PCA Infusion System before version 7.0 does not validate network traffic associated with sending a drug library, software update, or configuration change. This allows remote attackers to modify settings or medication data via packets on TELNET, HTTP, HTTPS, or UPNP ports.
Original NVD description (English source)
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.