Vulnerability in Hospira Lifecare Pca3

CVE-2014-5406

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port. NOTE: this issue might overlap CVE-2015-3459.

EPSS: 0.012 (66.1th percentile) — read the EPSS interpretation.

Affected products

Hospira Lifecare_pca3
Hospira Lifecare_pca5
Hospira Lifecare_pcainfusion_firmware
Hospira Lifecare Pca Infusion System — versions 7.0, 0

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

ics-cert@hq.dhs.gov
ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
ics-cert@hq.dhs.gov (x_refsource_MISC)
ics-cert@hq.dhs.gov
af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory, US Government Resource)