CVE-2014-5406CWE-345

Hospira LifeCare PCA Infusion System

High · published July 6, 2015

CVSS v2.0
7.6
EPSS
1%
Percentile
68.4
In the wild
Unconfirmed
What it is

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port. NOTE: this issue might overlap CVE-2015-3459.

The record
Technical detail
CVSS v2.0
7.6 · HIGH
Vector
AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS v4.0
Not supplied
EPSS
0.01218 · 68.4th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2015-07-06T19:10Z
EPSS history
Timeline
  • 06 JUL 19:10Z
    Hospira LifeCare PCA Infusion System
    cvelistv5