9.4

CVE-2018-14786: bd alaris_cc_firmware Improper Authentication

CVSS: 9.4v3.0CriticalModified
Published 23-08-2018Last modified 17-09-2024
Open JSON

Vulnerability summary

CVE-2018-14786 is a critical (CVSS 9.4) Improper Authentication vulnerability in bd alaris_cc_firmware. EPSS estimates a 3.06% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.4/10
010
Critical · v3.0 (NVD)
EPSS score
3.06%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 23-08-2018
    PublishedVulnerability first disclosed.
  2. 17-09-2024
    Last modifiedVulnerability information updated.

Description

Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper authentication vulnerability where the software does not perform authentication for functionality that requires a provable user identity, where it may allow a remote attacker to gain unauthorized access to various Alaris Syringe pumps and impact the intended operation of the pump when it is connected to a terminal server via the serial port.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

3.06%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

+0.03 pp

From 3.02% on 21-09-2026

21-09-202621-10-2026
EPSS score
3.06%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Bd4 products
Becton, dickinson and company1 product

2 vendors · 5 products

References

3 links