Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-22766— BD Pyxis Products - Hardcoded Credentials

Quick assessment

Affected
Becton Dickinson (BD) BD Pyxis Anesthesia Station ES
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

BD Pyxis是美国碧迪医疗（BD）公司的一套药物管理系统。 BD Pyxis 存在安全漏洞，该漏洞源于在特定的BD Pyxis产品中使用硬编码凭证。如果被利用，威胁参与者可能会获得对底层文件系统的访问权，并可能利用应用程序文件获取可用于解密应用程序凭证的信息，或获得对电子保护健康信息(ePHI)或其他敏感信息的访问权。

CVSS 7.0 · High EPSS 0.23% · P14
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-22766

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BD Pyxis Products - Hardcoded Credentials
Source: CVE Program / CVE List V5
Vulnerability Description
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
BD Pyxis 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
BD Pyxis是美国碧迪医疗（BD）公司的一套药物管理系统。 BD Pyxis 存在安全漏洞，该漏洞源于在特定的BD Pyxis产品中使用硬编码凭证。如果被利用，威胁参与者可能会获得对底层文件系统的访问权，并可能利用应用程序文件获取可用于解密应用程序凭证的信息，或获得对电子保护健康信息(ePHI)或其他敏感信息的访问权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Becton Dickinson (BD) BD Pyxis Anesthesia Station ES All -
Becton Dickinson (BD) BD Pyxis Anesthesia Station 4000 All -
Becton Dickinson (BD) BD Pyxis CATO All -
Becton Dickinson (BD) BD Pyxis CIISafe All -
Becton Dickinson (BD) BD Pyxis Inventory Connect All -
Becton Dickinson (BD) BD Pyxis IV Prep All -
Becton Dickinson (BD) BD Pyxis JITrBUD All -
Becton Dickinson (BD) BD Pyxis KanBan RF All -
Becton Dickinson (BD) BD Pyxis Logistics All -
Becton Dickinson (BD) BD Pyxis Med Link Family All -
Becton Dickinson (BD) BD Pyxis MedBank All -
Becton Dickinson (BD) BD Pyxis MedStation 4000 All -
Becton Dickinson (BD) BD Pyxis MedStation ES All -
Becton Dickinson (BD) BD Pyxis MedStation ES Server All -
Becton Dickinson (BD) BD Pyxis ParAssist All -
Becton Dickinson (BD) BD Pyxis PharmoPack All -
Becton Dickinson (BD) BD Pyxis ProcedureStation (including EC) All -
Becton Dickinson (BD) BD Pyxis Rapid Rx All -
Becton Dickinson (BD) BD Pyxis StockStation All -
Becton Dickinson (BD) BD Pyxis SupplyCenter All -
Becton Dickinson (BD) BD Pyxis SupplyRoller All -
Becton Dickinson (BD) BD Pyxis SupplyStation (including RF, EC, CP) All -
Becton Dickinson (BD) BD Pyxis Track and Deliver All -
Becton Dickinson (BD) BD Rowa Pouch Packaging Systems All -

II. Public POCs for CVE-2022-22766

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-22766

请登录查看更多情报信息。

Vendor Advisories for CVE-2022-22766 (1)

IV. Related Vulnerabilities

Same vendor: Becton Dickinson (BD)
Same weakness: CWE-798

V. Comments for CVE-2022-22766

No comments yet

Leave a comment