BD Alaris Infusion Central up to 1.3.2 Installation password recoverable

Summaryinfo

A vulnerability identified as problematic has been detected in BD Alaris Infusion Central up to 1.3.2. Affected by this issue is some unknown functionality of the component Installation Handler. The manipulation leads to password recoverable. This vulnerability is referenced as CVE-2022-47376. No exploit is available.

Detailsinfo

A vulnerability was found in BD Alaris Infusion Central up to 1.3.2 (Medical Device Software) and classified as problematic. This issue affects some unknown functionality of the component Installation Handler. The manipulation with an unknown input leads to a password recoverable vulnerability. Using CWE to declare the problem leads to CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. Impacted is confidentiality. The summary by CVE is:

The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.

The weakness was published 06/13/2023. The advisory is shared at bd.com. The identification of this vulnerability is CVE-2022-47376 since 12/13/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Medical Device Software

Vendor

• BD

Name

• Alaris Infusion Central

Version

• 1.3.0
• 1.3.1
• 1.3.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion