Back to Database
Status published
Critical
CVE-2015-3459
The communication module on the Hospira LifeCare PCA Infusion System...
Vulnerability Description
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-3459
Credits & Attribution
No credits recorded in the NVD database.
References
- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
- http://imgur.com/JHiWSqd
- http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
- https://twitter.com/dyngnosis/status/592671049487142913
- http://hextechsecurity.com/?p=123
- https://twitter.com/dyngnosis/status/592743461977219072
- http://imgur.com/CEAnZjj
- http://www.securityfocus.com/bid/74414
More from hospira
View All →CVE-2015-7909
Stack-based buffer overflow in Hospira Communication Engine (CE) before 1.2...
High
7.3
CVE-2015-3958
Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly...
High
7.8
CVE-2015-3957
Hospira LifeCare PCA Infusion System before 7.0 stores private keys...
Medium
4.6
CVE-2015-3955
Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0...
Critical
10
CVE-2015-1011
Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials,...
Medium
5
Affected Vendor
hospira
View all reports →Affected Software
lifecare pcainfusion firmware, lifecare pca3, lifecare pca5
Vulnerable Versions:
0
Timeline
Official Publish:
April 29th, 2015
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.