Description
The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.
Advisories 2
- ICSA-15-125-01 Hospira LifeCare PCA Infusion System Vulnerabilities CISA ICS & IT advisories · Jun 6, 2025
- ICSA-15-125-01B Hospira LifeCare PCA Infusion System Vulnerabilities CISA ICS & IT advisories · Jun 6, 2025
References
- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
- http://imgur.com/JHiWSqd
- http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm
- https://twitter.com/dyngnosis/status/592671049487142913
- http://hextechsecurity.com/?p=123
- https://twitter.com/dyngnosis/status/592743461977219072
- http://imgur.com/CEAnZjj
- 74414 vdb-entry