{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"LifeCare PCA Infusion System","vendor":"Hospira","versions":[{"lessThanOrEqual":"5.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"7.0"}]}],"credits":[{"lang":"en","type":"finder","value":"Billy Rios"}],"datePublic":"2015-05-05T06:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port.  NOTE: this issue might overlap CVE-2015-3459.</p>"}],"value":"The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port.  NOTE: this issue might overlap CVE-2015-3459."}],"metrics":[{"cvssV2_0":{"accessComplexity":"HIGH","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":7.6,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:H/Au:N/C:C/I:C/A:C","version":"2.0"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-345","description":"CWE-345","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","shortName":"icscert","dateUpdated":"2025-11-03T18:34:36.324Z"},"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-15-125-01"},{"tags":["x_refsource_MISC"],"url":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm"},{"tags":["x_refsource_MISC"],"url":"https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-125-01.json"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>ICS-CERT has been working with Hospira since May 2014 to address the \nvulnerabilities in the LifeCare PCA Infusion System. Hospira has \ndeveloped a new version of the PCS Infusion System, Version 7.0 that \naddresses the identified vulnerabilities. According to Hospira, \nVersion 7.0 has Port 20/FTP and Port 23/TELNET closed by default to \nprevent unauthorized access. Existing PCA Infusion Systems running \nVersion 5.0 can be upgraded to Version 7.0 when it becomes available. \nHospira’s Version 7.0 is being reviewed by the FDA prior to its release.\n The release date for Version 7.0 of the LifeCare PCA Infusion System \nhas not been determined.</p>\n<p>For additional information about Hospira’s new release, contact Hospira’s technical support at 1‑800-241-4002.</p>\n\n<br>"}],"value":"ICS-CERT has been working with Hospira since May 2014 to address the \nvulnerabilities in the LifeCare PCA Infusion System. Hospira has \ndeveloped a new version of the PCS Infusion System, Version 7.0 that \naddresses the identified vulnerabilities. According to Hospira, \nVersion 7.0 has Port 20/FTP and Port 23/TELNET closed by default to \nprevent unauthorized access. Existing PCA Infusion Systems running \nVersion 5.0 can be upgraded to Version 7.0 when it becomes available. \nHospira’s Version 7.0 is being reviewed by the FDA prior to its release.\n The release date for Version 7.0 of the LifeCare PCA Infusion System \nhas not been determined.\n\n\nFor additional information about Hospira’s new release, contact Hospira’s technical support at 1‑800-241-4002."}],"source":{"advisory":"ICSA-15-125-01","discovery":"EXTERNAL"},"title":"Hospira LifeCare PCA Infusion System","x_generator":{"engine":"Vulnogram 0.5.0"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2014-5406","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port.  NOTE: this issue might overlap CVE-2015-3459."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01"},{"name":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm","refsource":"MISC","url":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm"},{"name":"https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/","refsource":"MISC","url":"https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/"}]}}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-06T11:41:49.223Z"},"title":"CVE Program Container","references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/"}]}]},"cveMetadata":{"assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","assignerShortName":"icscert","cveId":"CVE-2014-5406","datePublished":"2015-07-06T19:10:00.000Z","dateReserved":"2014-08-22T00:00:00.000Z","dateUpdated":"2025-11-03T18:34:36.324Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"}