CVE-2023-30561

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
Becton Dickinson & Co	BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015	<= 12.1.3

References

https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mxMitigation, Vendor Advisory
https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mxMitigation, Vendor Advisory

Timeline

Published: Jul 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-305626.7A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.CVE-2023-305638.2A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.CVE-2023-305646.9Alaris Systems Manager does not perform input validation during the Device Import Function.CVE-2023-305653.5An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.CVE-2023-30579.8A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app CVE-2023-305707.5pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive CVE-2023-305715.3Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c change CVE-2023-305757.5Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake,CVE-2023-305768.1Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attac CVE-2023-305777.8AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different CVE-2023-30585.4A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the comp CVE-2023-305817.5The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jso