CISA ICSA-15-125-01: Hospira LifeCare PCA Infusion System Unauthenticated Remote Command Execution

Vulnerability ID: ICSA-15-125-01 CVE Number: CVE-2015-3459 CWE Number: CWE-285 (Improper Authorization) Affected Product: Hospira LifeCare PCA Infusion System <= 5.0 Vulnerability Description: The communication module on the Hospira LifeCare PCA Infusion System before version 7.0 does not require authentication, allowing remote attackers to send commands directly to the PCA. CVSSv2 Score: , rated 10.0, indicating a critical severity level. Mitigation Recommendations: CISA recommends users take the following actions to reduce the risk of exploitation: - Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from the business network. - When remote access is necessary, use secure remote access technologies such as Virtual Private Networks (VPNs). - Conduct proper impact analysis and risk assessment before deploying any solutions. - Implement recommended cybersecurity strategies for proactive defense and mitigation. - Additional mitigation guidance and recommended practices are publicly available on the ICS website. Publication Date: 2015-02-05 History: - Initial Publication: 2015-02-05 - Advisory converted into a CSAF: 2025-06-06 Publisher: CISA References: - ICS Advisory ICSA-15-125-01 JSON - ICS Advisory ICSA-15-125-01 - Web Version - Recommended Practices (Multiple links provided by CISA)

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-15-125-01: Hospira LifeCare PCA Infusion System Unauthenticated Remote Command Execution

More from this source