Vulnerability in Hospira Plum A+3 Infusion System
CVE-2015-3956
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
EPSS: 0.010 (57.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Hospira Plum A+3 Infusion System — versions <= 13.6
- Hospira Plum A+ Infusion System — versions <= 13.4
- Hospira Symbiq Infusion System — versions <= 3.13
- Pifzer Plum_a\+3_infusion_system
- Pifzer Plum_a\+3_infusion_system_firmware
- Pifzer Plum_a\+_infusion_system
- Pifzer Plum_a\+_infusion_system_firmware
- Pifzer Symbiq_infusion_system
- Pifzer Symbiq_infusion_system_firmware
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)
Frequently asked questions
- What is CVE-2015-3956?
- CVE-2015-3956 is a critical-severity vulnerability in Hospira Plum A+3 Infusion System, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.8/10. Published 2019-03-25.
- How severe is CVE-2015-3956?
- Critical severity. CVSS v3 base score is 9.8 out of 10.