Becton Dickinson & Co vulnerabilities
8 vulnerabilities
Known vulnerabilities in Becton Dickinson & Co products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.
Products
11- BD Alarisâ„¢ Point Of Care Unit (Pcu) Model 80152 vulnerabilities
- BD Alarisâ„¢ Systems Manager2 vulnerabilities
- BD Alarisâ„¢ Guardrailsâ„¢ Editor1 vulnerabilities
- BD Alaris™ Point Of Care Unit (Pcu) Model 80151 vulnerabilities
- BD Bactec™ Blood Culture System1 vulnerabilities
- BD COR™ System1 vulnerabilities
- BD Epicenter™ Microbiology Data Management System1 vulnerabilities
- BD MAX™ System1 vulnerabilities
- BD Phoenix™ M50 Automated Microbiology System1 vulnerabilities
- BD Synapsys™ Informatics Solution1 vulnerabilities
- CQI Reporter1 vulnerabilities
CVE-2024-10476becton dickinson & cobd bactec™ blood culture system+5
EPSS score0.24%
Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and personally identifiable information (PII). Exploitation of this vulnerability may allow an attacker to shut down or otherwise impact the availability of the system. Note: BD Synapsys™ Informatics
Solution is only in scope of
this vulnerability when
installed on a NUC server. BD Synapsys™
Informatics Solution installed
on a customer-provided virtual machine or on the BD Kiestra™ SCU hardware is
not in scope.CVE-2023-30561bdalaris_8015_pcu_firmware+1EPSS score0.19%
The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.CVE-2023-30560bdalaris_8015_pcu_firmware+1EPSS score0.30%
The configuration from the PCU can be modified without authentication using physical connection to the PCU.CVE-2023-30559bdalaris_8015_pcu_firmware+1EPSS score0.18%
The firmware update package for the wireless card is not properly signed and can be modified.CVE-2023-30562bdalaris_guardrails_editor+1EPSS score0.18%
A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.CVE-2023-30563bdalaris_systems_manager+1EPSS score0.44%
A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.CVE-2023-30564bdalaris_systems_manager+1EPSS score0.29%
Alaris Systems Manager does not perform input validation during the Device Import Function.CVE-2023-30565bdguardrails_cqi_reporter+1EPSS score0.14%
An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.