What is CVE-2014-5401?

CVE-2014-5401 is a critical-severity vulnerability in Hospira Mednet, classified under Code Injection. CVSS score: 9.8/10. Published 2019-03-26.

How severe is CVE-2014-5401?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Hospira Mednet

CVE-2014-5401

Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versions of MedNet can be upgraded to MedNet 6.1.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.050 (91.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hospira Mednet — versions 0, 6.1

Weakness classification (CWE)

CWE-94 — Code Injection

References

ics-cert@hq.dhs.gov
ics-cert@hq.dhs.gov
af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory, US Government Resource)

Frequently asked questions

What is CVE-2014-5401?: CVE-2014-5401 is a critical-severity vulnerability in Hospira Mednet, classified under Code Injection. CVSS score: 9.8/10. Published 2019-03-26.
How severe is CVE-2014-5401?: Critical severity. CVSS v3 base score is 9.8 out of 10.