Arbitrary file upload in Bd Alaris Cc Syringe Pump
CVE-2019-10959
BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.025 (84.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000
Affected products
- Bd Alaris Cc Syringe Pump
- Bd Alaris Cc Syringe Pump Firmware
- Bd Alaris Gateway Workstation
- Bd Alaris Gateway Workstation Firmware — versions 1.1.3, 1.2, 1.3.0
- Bd Alaris Gh Syringe Pump
- Bd Alaris Gh Syringe Pump Firmware
- Bd Alaris Gs Syringe Pump
- Bd Alaris Gs Syringe Pump Firmware
- Bd Alaris Tiva Syringe Pump
- Bd Alaris Tiva Syringe Pump Firmware
Weakness classification (CWE)
References
- ics-cert.us-cert.gov/advisories/ICSMA-19-164-01 (US Government Resource, Third Party Advisory, Mitigation)
- www.securityfocus.com/bid/108765 (VDB Entry, Third Party Advisory, vdb-entry)
- www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin… (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-10959?
- CVE-2019-10959 is a critical-severity vulnerability in Bd Alaris Cc Syringe Pump, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 10.0/10. Published 2019-06-13.
- How severe is CVE-2019-10959?
- Critical severity. CVSS v3 base score is 10.0 out of 10.