Critical severity · published Feb 13, 2017
CVE-2016-8355
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1
9.9
CVSS
1.5%
EPSS
No
On KEV
Description
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and delete users, and change user permissions. According to Smiths-Medical, physical access to the pump is required to install drug library updates.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Smiths-Medical CADD-Solis Medication Safety Software through 3.1 ·
Smiths-Medical CADD-Solis Medication Safety Software through 3.1 · source: vendor
CM
Cadd-solis Medication Safety Software · Smiths-medical
1.0; 2.0; 3.0; 3.1 · source: NVD
Affected product
SC
Smiths-Medical CADD-Solis Medication Safety Software through 3.1
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-8355
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-8355
Third Party Advisory
http://www.securityfocus.com/bid/94630
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01
More from Smiths-Medical CADD-Solis Medication Safety Software through 3.1
8.5
CVE-2016-8358
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1