CVE-2015-3459

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hextechsecurity.com/?p=123Broken Link
http://imgur.com/CEAnZjjNot Applicable
http://imgur.com/JHiWSqdNot Applicable
http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htmThird Party Advisory, US Government Resource
http://www.securityfocus.com/bid/74414Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01Third Party Advisory, US Government Resource
https://twitter.com/dyngnosis/status/592671049487142913Press/Media Coverage
https://twitter.com/dyngnosis/status/592743461977219072Press/Media Coverage
http://hextechsecurity.com/?p=123Broken Link
http://imgur.com/CEAnZjjNot Applicable
http://imgur.com/JHiWSqdNot Applicable
http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htmThird Party Advisory, US Government Resource
http://www.securityfocus.com/bid/74414Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01Third Party Advisory, US Government Resource
https://twitter.com/dyngnosis/status/592671049487142913Press/Media Coverage
https://twitter.com/dyngnosis/status/592743461977219072Press/Media Coverage

Timeline

Published: Apr 29, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-36105.4The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which CVE-2015-36118.8A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, whic CVE-2015-36125.4A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in t CVE-2015-36139.8A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page CVE-2015-36147.5Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving anothe CVE-2015-36155.4Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users CVE-2015-36169.8SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary co CVE-2015-36177.8Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.CVE-2015-36186.1Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitr CVE-2015-36195.4Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attacke CVE-2015-36204.3Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 throu CVE-2015-36219.3Untrusted search path vulnerability in SAP Enterprise Central Component (ECC) allows local users to gain privileges via a Trojan horse progr