Details of VAR-201504-0446

ID

VAR-201504-0446

CVE

CVE-2015-3459

TITLE

Hospira Lifecare PCA In infusion pumps root Privileged vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2015-002513

DESCRIPTION

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands. Hospira Lifecare PCA Infusion Pump is prone to a remote authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. Remote attackers can use TCP port 23 to exploit this vulnerability to gain root privileges

Trust: 2.07

sources: NVD: CVE-2015-3459 // JVNDB: JVNDB-2015-002513 // BID: 74414 // VULHUB: VHN-81420 // VULMON: CVE-2015-3459

AFFECTED PRODUCTS

vendor:	hospira	model:	lifecare pca3	scope:	eq	version:	-	Trust: 1.0
vendor:	hospira	model:	lifecare pca5	scope:	eq	version:	-	Trust: 1.0
vendor:	hospira	model:	lifecare pcainfusion	scope:	lte	version:	5.0	Trust: 1.0
vendor:	hospira	model:	lifecare pca infusion system	scope:	-	version:	-	Trust: 0.8
vendor:	hospira	model:	lifecare pca infusion system	scope:	eq	version:	412	Trust: 0.8
vendor:	hospira	model:	lifecare pcainfusion	scope:	eq	version:	5.0	Trust: 0.6

sources: JVNDB: JVNDB-2015-002513 // CNNVD: CNNVD-201504-595 // NVD: CVE-2015-3459

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-3459
value:	HIGH
Trust: 1.0
NVD:	CVE-2015-3459
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201504-595
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-81420
value:	HIGH
Trust: 0.1
VULMON:	CVE-2015-3459
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-3459
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-81420
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-81420 // VULMON: CVE-2015-3459 // JVNDB: JVNDB-2015-002513 // CNNVD: CNNVD-201504-595 // NVD: CVE-2015-3459

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-81420 // JVNDB: JVNDB-2015-002513 // NVD: CVE-2015-3459

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201504-595

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201504-595

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-002513

PATCH

title:	LifeCare PCA Infusion System	url:	http://www.hospira.com/en/products_and_services/infusion_pumps/Lifecare/	Trust: 0.8
title:	Threatpost	url:	https://threatpost.com/vulnerability-riddled-drug-pumps-open-to-takeover/112629/	Trust: 0.1

sources: VULMON: CVE-2015-3459 // JVNDB: JVNDB-2015-002513

EXTERNAL IDS

db:	NVD	id:	CVE-2015-3459	Trust: 2.9
db:	ICS CERT	id:	ICSA-15-125-01	Trust: 2.0
db:	BID	id:	74414	Trust: 1.5
db:	JVNDB	id:	JVNDB-2015-002513	Trust: 0.8
db:	CNNVD	id:	CNNVD-201504-595	Trust: 0.7
db:	VULHUB	id:	VHN-81420	Trust: 0.1
db:	ICS CERT	id:	ICSA-15-125-01B	Trust: 0.1
db:	VULMON	id:	CVE-2015-3459	Trust: 0.1

sources: VULHUB: VHN-81420 // VULMON: CVE-2015-3459 // BID: 74414 // JVNDB: JVNDB-2015-002513 // CNNVD: CNNVD-201504-595 // NVD: CVE-2015-3459

REFERENCES

url:	https://twitter.com/dyngnosis/status/592671049487142913	Trust: 2.6
url:	https://twitter.com/dyngnosis/status/592743461977219072	Trust: 2.6
url:	http://www.fda.gov/medicaldevices/safety/alertsandnotices/ucm446809.htm	Trust: 2.0
url:	https://ics-cert.us-cert.gov/advisories/icsa-15-125-01	Trust: 2.0
url:	http://imgur.com/ceanzjj	Trust: 1.8
url:	http://imgur.com/jhiwsqd	Trust: 1.8
url:	http://www.securityfocus.com/bid/74414	Trust: 1.3
url:	http://hextechsecurity.com/?p=123	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3459	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3459	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/264.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://threatpost.com/vulnerability-riddled-drug-pumps-open-to-takeover/112629/	Trust: 0.1
url:	https://ics-cert.us-cert.gov/advisories/icsa-15-125-01b	Trust: 0.1

sources: VULHUB: VHN-81420 // VULMON: CVE-2015-3459 // JVNDB: JVNDB-2015-002513 // CNNVD: CNNVD-201504-595 // NVD: CVE-2015-3459

CREDITS

dyngnosis

Trust: 0.3

sources: BID: 74414

SOURCES

db:	VULHUB	id:	VHN-81420
db:	VULMON	id:	CVE-2015-3459
db:	BID	id:	74414
db:	JVNDB	id:	JVNDB-2015-002513
db:	CNNVD	id:	CNNVD-201504-595
db:	NVD	id:	CVE-2015-3459

LAST UPDATE DATE

2025-04-13T23:09:18.868000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-81420	date:	2017-01-03T00:00:00
db:	VULMON	id:	CVE-2015-3459	date:	2017-01-03T00:00:00
db:	BID	id:	74414	date:	2015-07-15T00:29:00
db:	JVNDB	id:	JVNDB-2015-002513	date:	2015-05-20T00:00:00
db:	CNNVD	id:	CNNVD-201504-595	date:	2015-05-04T00:00:00
db:	NVD	id:	CVE-2015-3459	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-81420	date:	2015-04-29T00:00:00
db:	VULMON	id:	CVE-2015-3459	date:	2015-04-29T00:00:00
db:	BID	id:	74414	date:	2015-04-27T00:00:00
db:	JVNDB	id:	JVNDB-2015-002513	date:	2015-05-01T00:00:00
db:	CNNVD	id:	CNNVD-201504-595	date:	2015-04-30T00:00:00
db:	NVD	id:	CVE-2015-3459	date:	2015-04-29T23:59:00.057