Most recent entries from all

cnvd-2017-01600

EUVD-2026-87826

fkie_cve-2016-9355

An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience.

GHSA-4mq5-8ppx-r669

gsd-2016-9355

ICSMA-17-017-02 — BD Alaris 8015 PC Unit (Update B)

An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by removing the external Wi-Fi card from an Alaris 8015 PC unit and connecting a pre-programmed malicious CF (CompactFlash) card to perform the attack.CVE-2016-8375 has been assigned to this vulnerability. A CVSS v3 base score of 4.9 has been calculated; the CVSS vector string is (AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). An unauthorized user with physical access to an Alaris 8015 PC unit may be able to disassemble the device to access the removable flash memory, allowing read-and-write access to device memory. Physical access to the CF card allows an attacker to overwrite application and internal data (logs, drug library, etc.). Older software versions of the Alaris 8015 PC unit (Version 9.5 and prior) store wireless network authentication credentials and other sensitive technical data on the affected device 's removable flash memory. It is not difficult to obtain this data, but very difficult to interpret and change it to create an exploit that is progressive. In addition, the proprietary nature of the stored data format makes it unlikely modification of the CF card would go undetected.CVE-2016-9355 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).