CVE-2015-1012

Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01	Mitigation US Government Resource Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:pfizer:lifecare_pca_infusion_system_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:pfizer:lifecare_pca_infusion_system:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-03-25 19:29

Updated : 2023-12-10 12:59

NVD link : CVE-2015-1012

Mitre link : CVE-2015-1012

CVE.ORG link : CVE-2015-1012

JSON object : View

Products Affected

pfizer

lifecare_pca_infusion_system
lifecare_pca_infusion_system_firmware

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2015-1012", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-03-25T19:29:00.290", "references": [{"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01", "tags": ["Mitigation", "US Government Resource", "Third Party Advisory"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access."}, {"lang": "es", "value": "Las claves inal\u00e1mbricas se almacenan como texto en claro en la versi\u00f3n 5 de Hospira LifeCare PCA Infusion System. Seg\u00fan Hospira, la versi\u00f3n 3 del LifeCare PCA Infusion System no est\u00e1 indicada para un uso inal\u00e1mbrico, no est\u00e1 equipada con capacidades inal\u00e1mbricas y no se deber\u00eda modificar para que se use en modo inal\u00e1mbrico en un entorno cl\u00ednico. Hospira ha desarrollado una nueva versi\u00f3n del PCS Infusion System, la 7.0, que aborda las vulnerabilidades identificadas. En la versi\u00f3n 7.0, el Puerto 20/FTP y el Puerto 23/TELNET est\u00e1n cerrados por defecto para evitar el acceso no autorizado."}], "lastModified": "2019-10-09T23:13:03.783", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:pfizer:lifecare_pca_infusion_system_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAA18842-CF1B-4B64-95AB-57404B664C84", "versionEndIncluding": "5.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:pfizer:lifecare_pca_infusion_system:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BC81FC0C-02D8-4BD7-83EB-7E510D241A50"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}