Hospira LifeCare PCA Infusion System information disclosure

Summaryinfo

A vulnerability was found in Hospira LifeCare PCA Infusion System. It has been rated as critical. This affects an unknown part. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2015-1012. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Hospira LifeCare PCA Infusion System (Medical Device Software) (version unknown). This issue affects an unknown function. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access.

The bug was discovered 06/10/2015. The weakness was disclosed 03/25/2019 (Website). It is possible to read the advisory at ics-cert.us-cert.gov. The identification of this vulnerability is CVE-2015-1012 since 01/10/2015. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 1384 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability.

The entry VDB-76305 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Medical Device Software

Vendor

• Hospira

Name

• LifeCare PCA Infusion System

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion