Arbitrary file upload in Bd Alaris Cc Syringe Pump
CVE-2019-10959
BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.
Vulnerability class: Unrestricted File Upload
EPSS: 0.025 (83.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Bd Alaris_cc_syringe_pump
- Bd Alaris_cc_syringe_pump_firmware
- Bd Alaris_gateway_workstation
- Bd Alaris_gateway_workstation_firmware — versions 1.1.3, 1.2, 1.3.0
- Bd Alaris_gh_syringe_pump
- Bd Alaris_gh_syringe_pump_firmware
- Bd Alaris_gs_syringe_pump
- Bd Alaris_gs_syringe_pump_firmware
- Bd Alaris_tiva_syringe_pump
- Bd Alaris_tiva_syringe_pump_firmware
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- nvd@nist.gov (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-10959?
- CVE-2019-10959 is a critical-severity vulnerability in Bd Alaris Cc Syringe Pump, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 10.0/10. Published 2019-06-13.
- How severe is CVE-2019-10959?
- Critical severity. CVSS v3 base score is 10.0 out of 10.