var-201504-0446
Vulnerability from variot
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands. Hospira Lifecare PCA Infusion Pump is prone to a remote authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. Remote attackers can use TCP port 23 to exploit this vulnerability to gain root privileges
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201504-0446",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lifecare pcainfusion",
"scope": "lte",
"trust": 1.0,
"vendor": "hospira",
"version": "5.0"
},
{
"model": "lifecare pca5",
"scope": "eq",
"trust": 1.0,
"vendor": "hospira",
"version": null
},
{
"model": "lifecare pca3",
"scope": "eq",
"trust": 1.0,
"vendor": "hospira",
"version": null
},
{
"model": "lifecare pca infusion system",
"scope": null,
"trust": 0.8,
"vendor": "hospira",
"version": null
},
{
"model": "lifecare pca infusion system",
"scope": "eq",
"trust": 0.8,
"vendor": "hospira",
"version": "412"
},
{
"model": "lifecare pcainfusion",
"scope": "eq",
"trust": 0.6,
"vendor": "hospira",
"version": "5.0"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"db": "CNNVD",
"id": "CNNVD-201504-595"
},
{
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:hospira:lifecare_pca_infusion_system",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:hospira:lifecare_pcainfusion_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "dyngnosis",
"sources": [
{
"db": "BID",
"id": "74414"
}
],
"trust": 0.3
},
"cve": "CVE-2015-3459",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2015-3459",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-81420",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-3459",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2015-3459",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201504-595",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-81420",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2015-3459",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-81420"
},
{
"db": "VULMON",
"id": "CVE-2015-3459"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"db": "CNNVD",
"id": "CNNVD-201504-595"
},
{
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands. Hospira Lifecare PCA Infusion Pump is prone to a remote authentication-bypass vulnerability. \nAn attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. Remote attackers can use TCP port 23 to exploit this vulnerability to gain root privileges",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-3459"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"db": "BID",
"id": "74414"
},
{
"db": "VULHUB",
"id": "VHN-81420"
},
{
"db": "VULMON",
"id": "CVE-2015-3459"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-3459",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-15-125-01",
"trust": 2.0
},
{
"db": "BID",
"id": "74414",
"trust": 1.5
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201504-595",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-81420",
"trust": 0.1
},
{
"db": "ICS CERT",
"id": "ICSA-15-125-01B",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2015-3459",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-81420"
},
{
"db": "VULMON",
"id": "CVE-2015-3459"
},
{
"db": "BID",
"id": "74414"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"db": "CNNVD",
"id": "CNNVD-201504-595"
},
{
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"id": "VAR-201504-0446",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-81420"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T21:54:56.021000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "LifeCare PCA Infusion System",
"trust": 0.8,
"url": "http://www.hospira.com/en/products_and_services/infusion_pumps/Lifecare/"
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/vulnerability-riddled-drug-pumps-open-to-takeover/112629/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2015-3459"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-81420"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://twitter.com/dyngnosis/status/592671049487142913"
},
{
"trust": 2.6,
"url": "https://twitter.com/dyngnosis/status/592743461977219072"
},
{
"trust": 2.0,
"url": "http://www.fda.gov/medicaldevices/safety/alertsandnotices/ucm446809.htm"
},
{
"trust": 2.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-125-01"
},
{
"trust": 1.8,
"url": "http://imgur.com/ceanzjj"
},
{
"trust": 1.8,
"url": "http://imgur.com/jhiwsqd"
},
{
"trust": 1.3,
"url": "http://www.securityfocus.com/bid/74414"
},
{
"trust": 1.2,
"url": "http://hextechsecurity.com/?p=123"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3459"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3459"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/264.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://threatpost.com/vulnerability-riddled-drug-pumps-open-to-takeover/112629/"
},
{
"trust": 0.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-125-01b"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-81420"
},
{
"db": "VULMON",
"id": "CVE-2015-3459"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"db": "CNNVD",
"id": "CNNVD-201504-595"
},
{
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-81420"
},
{
"db": "VULMON",
"id": "CVE-2015-3459"
},
{
"db": "BID",
"id": "74414"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"db": "CNNVD",
"id": "CNNVD-201504-595"
},
{
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-04-29T00:00:00",
"db": "VULHUB",
"id": "VHN-81420"
},
{
"date": "2015-04-29T00:00:00",
"db": "VULMON",
"id": "CVE-2015-3459"
},
{
"date": "2015-04-27T00:00:00",
"db": "BID",
"id": "74414"
},
{
"date": "2015-05-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"date": "2015-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201504-595"
},
{
"date": "2015-04-29T23:59:00.057000",
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-01-03T00:00:00",
"db": "VULHUB",
"id": "VHN-81420"
},
{
"date": "2017-01-03T00:00:00",
"db": "VULMON",
"id": "CVE-2015-3459"
},
{
"date": "2015-07-15T00:29:00",
"db": "BID",
"id": "74414"
},
{
"date": "2015-05-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-002513"
},
{
"date": "2015-05-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201504-595"
},
{
"date": "2024-11-21T02:29:28.110000",
"db": "NVD",
"id": "CVE-2015-3459"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201504-595"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hospira Lifecare PCA In infusion pumps root Privileged vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-002513"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201504-595"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…