Vulnerability in Hospira Plum A+3 Infusion System
CVE-2015-3956
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (59.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 59.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Hospira Plum A+3 Infusion System — versions <= 13.6
- Hospira Plum A+ Infusion System — versions <= 13.4
- Hospira Symbiq Infusion System — versions <= 3.13
- Pifzer Plum A\+3 Infusion System
- Pifzer Plum A\+3 Infusion System Firmware
- Pifzer Plum A\+ Infusion System
- Pifzer Plum A\+ Infusion System Firmware
- Pifzer Symbiq Infusion System
- Pifzer Symbiq Infusion System Firmware
Weakness classification (CWE)
References
- ics-cert.us-cert.gov/advisories/ICSA-15-161-01 (US Government Resource, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2015-3956?
- CVE-2015-3956 is a critical-severity vulnerability in Hospira Plum A+3 Infusion System, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.8/10. Published 2019-03-25.
- How severe is CVE-2015-3956?
- Critical severity. CVSS v3 base score is 9.8 out of 10.