Critical ICSA-15-161-01 7 CVEs

Hospira Plum A+ and Symbiq Infusion Systems Vulnerabilities

Published Mar 13, 2015 · Updated Jun 6, 2025 · Revision 2

Vendor: Hospira Product: Plum A+ Infusion System Product: Plum A+3 Infusion System Product: Symbiq Infusion System,As previously announced by Hospira in 2013, the Symbiq Infusion System was retired by Hospira on May 31, 2015 and will be fully removed from the market by December 201

Vulnerabilities 7

Unscored —

CVE-2015-3952

Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Sys…

Hospira Symbiq Infusion System Plum A+ Infusion System Plum A+3 Infusion System

Mar 25, 2019
Unscored —

CVE-2015-3953

Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Sys…

Hospira Symbiq Infusion System Plum A+3 Infusion System Plum A+ Infusion System

Mar 25, 2019
Unscored —

CVE-2015-3954

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Inf…

Hospira Symbiq Infusion System Plum A+3 Infusion System Plum A+ Infusion System

Mar 25, 2019
Unscored —

CVE-2015-3955

Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allow…

Jul 6, 2015
Unscored —

CVE-2015-3956

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Inf…

Hospira Symbiq Infusion System Plum A+3 Infusion System Plum A+ Infusion System

Mar 25, 2019
Unscored —

CVE-2015-3957

Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and …

Jul 6, 2015
Unscored —

CVE-2015-3958

Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a d…

Jul 6, 2015

Revision history

2025-06-06 #2
Advisory converted into a CSAF
2015-03-13 #1
Initial Publication

References

ICS Advisory ICSA-15-161-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-15-161-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014