Becton Dickinson BD BACTEC Blood Culture System default credentials

Summaryinfo

A vulnerability, which was classified as critical, was found in Becton Dickinson BD BACTEC Blood Culture System, BD COR System, BD EpiCenter Microbiology Data Management System, BD MAX System, BD Phoenix M50 Automated Microbiology System and BD Synapsys Informatics Solution. This affects an unknown part. Such manipulation leads to default credentials. This vulnerability is uniquely identified as CVE-2024-10476. The attack can only be initiated within the local network. No exploit exists.

Detailsinfo

A vulnerability was found in Becton Dickinson BD BACTEC Blood Culture System, BD COR System, BD EpiCenter Microbiology Data Management System, BD MAX System, BD Phoenix M50 Automated Microbiology System and BD Synapsys Informatics Solution and classified as critical. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a default credentials vulnerability. Using CWE to declare the problem leads to CWE-1392. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and personally identifiable information (PII). Exploitation of this vulnerability may allow an attacker to shut down or otherwise impact the availability of the system. Note: BD Synapsys™ Informatics Solution is only in scope of this vulnerability when installed on a NUC server. BD Synapsys™ Informatics Solution installed on a customer-provided virtual machine or on the BD Kiestra™ SCU hardware is not in scope.

The advisory is shared for download at bd.com. This vulnerability is handled as CVE-2024-10476 since 10/28/2024. The exploitation is known to be difficult. The attack can only be initiated within the local network. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/17/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Automation Software

Vendor

• Becton Dickinson

Name

• BD BACTEC Blood Culture System
• BD COR System
• BD EpiCenter Microbiology Data Management System
• BD MAX System
• BD Phoenix M50 Automated Microbiology System
• BD Synapsys Informatics Solution

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion