Critical severity · published Aug 23, 2018
CVE-2018-14786
Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper…
9.4
CVSS
2.9%
EPSS
No
On KEV
Description
Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper authentication vulnerability where the software does not perform authentication for functionality that requires a provable user identity, where it may allow a remote attacker to gain unauthorized access to various Alaris Syringe pumps and impact the intended operation of the pump when it is connected to a terminal server via the serial port.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Alaris CC Firmware · BD
through 2.3.6 · source: NVD
AG
Alaris GH Firmware · BD
through 2.3.6 · source: NVD
AG
Alaris GS Firmware · BD
through 2.3.6 · source: NVD
AT
Alaris Tiva Firmware · BD
through 2.3.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14786
Vendor Advisory
http://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin-for-various-alaris-plus-syringe-pumps-sold-and-in-use-outside-the-united-states
Third Party Advisory
http://www.securityfocus.com/bid/105147
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-18-235-01