CVE-2015-3459

Published: Apr 29, 2015Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.

Affected (3)

Products: Hospira: Lifecare Pcainfusion Firmware, Lifecare Pca3, Lifecare Pca5

Hospira

3 products

Lifecare Pcainfusion Firmware

Lifecare Pca3

Lifecare Pca5

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Hospira Lifecare Pcainfusion Firmware	Up to 5.0
Hospira Lifecare Pca3	All versions
Hospira Lifecare Pca5	All versions

Related CWEs

CWE-264

References (16)

http://hextechsecurity.com/?p=123

Source: cve@mitre.org

Broken Link

http://imgur.com/CEAnZjj

Source: cve@mitre.org

Not Applicable

http://imgur.com/JHiWSqd

Source: cve@mitre.org

Not Applicable

http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/74414

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://twitter.com/dyngnosis/status/592671049487142913

Source: cve@mitre.org

Press/Media Coverage

https://twitter.com/dyngnosis/status/592743461977219072

Source: cve@mitre.org

Press/Media Coverage

http://hextechsecurity.com/?p=123