Medium severity · published Feb 11, 2022
CVE-2022-22766
Hardcoded credentials are used in specific BD Pyxis products
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pyxis Anesthesia Station 4000 Firmware · BD
All versions, or not specified · source: NVD
PA
Pyxis Anesthesia Station ES Firmware · BD
All versions, or not specified · source: NVD
PC
Pyxis Cato Firmware · BD
All versions, or not specified · source: NVD
PC
Pyxis Ciisafe Firmware · BD
All versions, or not specified · source: NVD
PI
Pyxis IV Prep Firmware · BD
All versions, or not specified · source: NVD
PI
Pyxis Inventory Connect Firmware · BD
All versions, or not specified · source: NVD
PJ
Pyxis Jitrbud Firmware · BD
All versions, or not specified · source: NVD
PK
Pyxis Kanban RF Firmware · BD
All versions, or not specified · source: NVD
PL
Pyxis Logistics Firmware · BD
All versions, or not specified · source: NVD
PM
Pyxis Med Link Family Firmware · BD
All versions, or not specified · source: NVD
PM
Pyxis Medbank Firmware · BD
All versions, or not specified · source: NVD
PM
Pyxis Medstation 4000 Firmware · BD
All versions, or not specified · source: NVD
Affected product
PA
Pyxis Anesthesia Station 4000 Firmware
BD
