CVE-2015-3958
HighSummary
The Hospira LifeCare PCA Infusion System version 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (forced manual reboot) via a flood of TCP packets.
Risk Assessment
Attackers can disrupt the operation of the infusion system, potentially leading to serious health consequences for patients.
Recommendation
It is recommended to update the system to the latest version and implement protections against TCP flood attacks.
Other vulnerabilities in Hospira LifeCare PCA Infusion System
See all- CVE-2015-3955High
A stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier allows remote attackers to execute arbitrary code.
- CVE-2014-5406High
The Hospira LifeCare PCA Infusion System before version 7.0 does not validate network traffic associated with sending a drug library, software update, or configuration change. This allows remote attackers to modify settings or medication data via packets on TELNET, HTTP, HTTPS, or UPNP ports.
- CVE-2015-3459High
The communication module on the Hospira LifeCare PCA Infusion System before version 7.0 does not require authentication for root TELNET sessions, allowing remote attackers to modify the pump configuration via unspecified commands.
Original NVD description (English source)
Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (forced manual reboot) via a flood of TCP packets.