CVE-2015-3459

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0180%

EPSS Percentile35.93th

Published2015年4月29日

Last Modified2026年5月6日

Vulnerability Description

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.

Affected Platforms (CPE)

💻

Hospira

Lifecare Pcainfusion Firmware

<= 5.0

🔌

Hospira

Lifecare Pca3

All versions

🔌

Hospira

Lifecare Pca5

All versions

References & Advisories

🔗 http://hextechsecurity.com/?p=123

🔗 http://imgur.com/CEAnZjj

🔗 http://imgur.com/JHiWSqd

🔗 http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm

🔗 http://www.securityfocus.com/bid/74414

🔗 https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01

🔗 https://twitter.com/dyngnosis/status/592671049487142913

🔗 https://twitter.com/dyngnosis/status/592743461977219072

Vulnerability Description

Affected Platforms (CPE)

Lifecare Pcainfusion Firmware

Lifecare Pca3

Lifecare Pca5

References & Advisories

関連する脆弱性情報