Details of VAR-201903-0654

ID

VAR-201903-0654

CVE

CVE-2015-3953

TITLE

plural Hospira Product Vulnerabilities related to the use of hard-coded credentials

Trust: 0.8

sources: JVNDB: JVNDB-2015-008248

DESCRIPTION

Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue. Multiple Hospira Products are prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device

Trust: 2.07

sources: NVD: CVE-2015-3953 // JVNDB: JVNDB-2015-008248 // BID: 75135 // VULHUB: VHN-81914 // VULMON: CVE-2015-3953

AFFECTED PRODUCTS

vendor:	pifzer	model:	plum a\+3 infusion system	scope:	lte	version:	13.6	Trust: 1.0
vendor:	pifzer	model:	plum a\+ infusion system	scope:	lte	version:	13.4	Trust: 1.0
vendor:	pifzer	model:	symbiq infusion system	scope:	lte	version:	3.13	Trust: 1.0
vendor:	pfizer	model:	symbiq infusion system	scope:	lte	version:	3.13	Trust: 0.8
vendor:	hospira	model:	plum a+ infusion system	scope:	lte	version:	13.4	Trust: 0.8
vendor:	hospira	model:	plum a+3 infusion system	scope:	lte	version:	13.6	Trust: 0.8
vendor:	hospira	model:	symbiq infusion system	scope:	eq	version:	3.13	Trust: 0.3
vendor:	hospira	model:	plum a+3 infusion system	scope:	eq	version:	13.6	Trust: 0.3
vendor:	hospira	model:	plum a+ infusion system	scope:	eq	version:	13.4	Trust: 0.3

sources: BID: 75135 // JVNDB: JVNDB-2015-008248 // NVD: CVE-2015-3953

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-3953
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2015-3953
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201506-474
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-81914
value:	HIGH
Trust: 0.1
VULMON:	CVE-2015-3953
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-3953
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-81914
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-3953
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-81914 // VULMON: CVE-2015-3953 // JVNDB: JVNDB-2015-008248 // CNNVD: CNNVD-201506-474 // NVD: CVE-2015-3953

PROBLEMTYPE DATA

problemtype:	CWE-798	Trust: 1.9
problemtype:	CWE-259	Trust: 1.0

sources: VULHUB: VHN-81914 // JVNDB: JVNDB-2015-008248 // NVD: CVE-2015-3953

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201506-474

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201506-474

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-008248

PATCH

title:

Top Page

url:

https://www.pfizer.com/

Trust: 0.8

sources: JVNDB: JVNDB-2015-008248

EXTERNAL IDS

db:	NVD	id:	CVE-2015-3953	Trust: 2.9
db:	ICS CERT	id:	ICSA-15-161-01	Trust: 2.9
db:	JVNDB	id:	JVNDB-2015-008248	Trust: 0.8
db:	CNNVD	id:	CNNVD-201506-474	Trust: 0.7
db:	BID	id:	75135	Trust: 0.5
db:	VULHUB	id:	VHN-81914	Trust: 0.1
db:	VULMON	id:	CVE-2015-3953	Trust: 0.1

sources: VULHUB: VHN-81914 // VULMON: CVE-2015-3953 // BID: 75135 // JVNDB: JVNDB-2015-008248 // CNNVD: CNNVD-201506-474 // NVD: CVE-2015-3953

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-15-161-01	Trust: 3.0
url:	https://nvd.nist.gov/vuln/detail/cve-2015-3953	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3953	Trust: 0.8
url:	http://www.hospira.com/en/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/798.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.securityfocus.com/bid/75135	Trust: 0.1

sources: VULHUB: VHN-81914 // VULMON: CVE-2015-3953 // BID: 75135 // JVNDB: JVNDB-2015-008248 // CNNVD: CNNVD-201506-474 // NVD: CVE-2015-3953

CREDITS

Billy Rios

Trust: 0.9

sources: BID: 75135 // CNNVD: CNNVD-201506-474

SOURCES

db:	VULHUB	id:	VHN-81914
db:	VULMON	id:	CVE-2015-3953
db:	BID	id:	75135
db:	JVNDB	id:	JVNDB-2015-008248
db:	CNNVD	id:	CNNVD-201506-474
db:	NVD	id:	CVE-2015-3953

LAST UPDATE DATE

2024-11-23T21:37:35.676000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-81914	date:	2019-10-09T00:00:00
db:	VULMON	id:	CVE-2015-3953	date:	2019-10-09T00:00:00
db:	BID	id:	75135	date:	2015-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2015-008248	date:	2019-05-10T00:00:00
db:	CNNVD	id:	CNNVD-201506-474	date:	2019-10-10T00:00:00
db:	NVD	id:	CVE-2015-3953	date:	2024-11-21T02:30:08.053

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-81914	date:	2019-03-25T00:00:00
db:	VULMON	id:	CVE-2015-3953	date:	2019-03-25T00:00:00
db:	BID	id:	75135	date:	2015-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2015-008248	date:	2019-05-10T00:00:00
db:	CNNVD	id:	CNNVD-201506-474	date:	2015-06-24T00:00:00
db:	NVD	id:	CVE-2015-3953	date:	2019-03-25T17:29:00.623