CVE-2019-10959CWE-434

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest…

published June 13, 2019

CVSS
—
EPSS
3%
Percentile
84.8
In the wild
Unconfirmed
What it is

⚠️ Firmware updates are supposed to make things better, not worse! Unfortunately, certain versions of the BD Alaris Gateway Workstation allow the upload of malicious files during updates, leaving the door wide open! Think of it like a restaurant that checks your ID at the door but forgets to check your order before serving — if they take in any meal without question, they might accidentally serve something dangerous! This vulnerability can be absolutely devastating. An attacker could upload harmful files during firmware updates, potentially compromising the entire system and leading to unauthorized access or even data manipulation. Imagine critical medical devices being put at risk — it’s a recipe for disaster!

Put simply

Think of it like a restaurant that checks your ID at the door but forgets to check your order before serving — if they take in any meal without question, they might accidentally serve something dangerous! The vulnerability arises because the application does not properly restrict the upload of files during firmware updates, especially in BD Alaris Gateway Workstation versions 1.1.3 through 1.3.1, and relevant products running software version 2.3.6 and below.

What to do

This vulnerability can be absolutely devastating. An attacker could upload harmful files during firmware updates, potentially compromising the entire system and leading to unauthorized access or even data manipulation. Imagine critical medical devices being put at risk — it’s a recipe for disaster! To protect your systems, update the BD Alaris Gateway Workstation to version 1.3.2 or higher immediately. Additionally, ensure that all other affected products are updated to the latest firmware available. Always verify file integrity before accepting uploads during updates! You've got this! With these steps, your systems will be more secure in no time! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02528 · 84.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2019-06-13T20:03Z
EPSS history
Timeline
  • 13 JUN 20:03Z
    BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest…
    cvelistv5