{"schemaVersion":3,"id":"CVE-2022-22766","aliases":[],"status":"published","duplicateOf":null,"title":"BD Pyxis Products - Hardcoded Credentials","description":"Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.","dates":{"published":"2022-02-11T18:12:07.247Z","modified":"2024-09-16T19:15:26.998Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":2.1,"severity":"low","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00228,"percentile":0.12798,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00228},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00228,"percentile":0.12798}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00228,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00228,"percentile":0.12798}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-798","name":"Use of Hard-coded Credentials","description":"The product contains hard-coded credentials, such as a password or cryptographic key.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/798.html"}],"affected":[{"vendor":"becton dickinson (bd)","product":"bd pyxis anesthesia station 4000","name":"BD Pyxis Anesthesia Station 4000","label":"bd pyxis anesthesia station 4000","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_anesthesia_station_4000"},{"vendor":"becton dickinson (bd)","product":"bd pyxis anesthesia station es","name":"BD Pyxis Anesthesia Station ES","label":"bd pyxis anesthesia station es","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_anesthesia_station_es"},{"vendor":"becton dickinson (bd)","product":"bd pyxis cato","name":"BD Pyxis CATO","label":"bd pyxis cato","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_cato"},{"vendor":"becton dickinson (bd)","product":"bd pyxis ciisafe","name":"BD Pyxis CIISafe","label":"bd pyxis ciisafe","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_ciisafe"},{"vendor":"becton dickinson (bd)","product":"bd pyxis inventory connect","name":"BD Pyxis Inventory Connect","label":"bd pyxis inventory connect","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_inventory_connect"},{"vendor":"becton dickinson (bd)","product":"bd pyxis iv prep","name":"BD Pyxis IV Prep","label":"bd pyxis iv prep","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_iv_prep"},{"vendor":"becton dickinson (bd)","product":"bd pyxis jitrbud","name":"BD Pyxis JITrBUD","label":"bd pyxis jitrbud","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_jitrbud"},{"vendor":"becton dickinson (bd)","product":"bd pyxis kanban rf","name":"BD Pyxis KanBan RF","label":"bd pyxis kanban rf","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_kanban_rf"},{"vendor":"becton dickinson (bd)","product":"bd pyxis logistics","name":"BD Pyxis Logistics","label":"bd pyxis logistics","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_logistics"},{"vendor":"becton dickinson (bd)","product":"bd pyxis med link family","name":"BD Pyxis Med Link Family","label":"bd pyxis med link family","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_med_link_family"},{"vendor":"becton dickinson (bd)","product":"bd pyxis medbank","name":"BD Pyxis MedBank","label":"bd pyxis medbank","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_medbank"},{"vendor":"becton dickinson (bd)","product":"bd pyxis medstation 4000","name":"BD Pyxis MedStation 4000","label":"bd pyxis medstation 4000","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_medstation_4000"},{"vendor":"becton dickinson (bd)","product":"bd pyxis medstation es","name":"BD Pyxis MedStation ES","label":"bd pyxis medstation es","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_medstation_es"},{"vendor":"becton dickinson (bd)","product":"bd pyxis medstation es server","name":"BD Pyxis MedStation ES Server","label":"bd pyxis medstation es server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_medstation_es_server"},{"vendor":"becton dickinson (bd)","product":"bd pyxis parassist","name":"BD Pyxis ParAssist","label":"bd pyxis parassist","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_parassist"},{"vendor":"becton dickinson (bd)","product":"bd pyxis pharmopack","name":"BD Pyxis PharmoPack","label":"bd pyxis pharmopack","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_pharmopack"},{"vendor":"becton dickinson (bd)","product":"bd pyxis procedurestation (including ec)","name":"BD Pyxis ProcedureStation (including EC)","label":"bd pyxis procedurestation (including ec)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_procedurestation_including_ec"},{"vendor":"becton dickinson (bd)","product":"bd pyxis rapid rx","name":"BD Pyxis Rapid Rx","label":"bd pyxis rapid rx","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_rapid_rx"},{"vendor":"becton dickinson (bd)","product":"bd pyxis stockstation","name":"BD Pyxis StockStation","label":"bd pyxis stockstation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_stockstation"},{"vendor":"becton dickinson (bd)","product":"bd pyxis supplycenter","name":"BD Pyxis SupplyCenter","label":"bd pyxis supplycenter","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_supplycenter"},{"vendor":"becton dickinson (bd)","product":"bd pyxis supplyroller","name":"BD Pyxis SupplyRoller","label":"bd pyxis supplyroller","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_supplyroller"},{"vendor":"becton dickinson (bd)","product":"bd pyxis supplystation (including rf, ec, cp)","name":"BD Pyxis SupplyStation (including RF, EC, CP)","label":"bd pyxis supplystation (including rf, ec, cp)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_supplystation_including_rf_ec_cp"},{"vendor":"becton dickinson (bd)","product":"bd pyxis track and deliver","name":"BD Pyxis Track and Deliver","label":"bd pyxis track and deliver","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_pyxis_track_and_deliver"},{"vendor":"becton dickinson (bd)","product":"bd rowa pouch packaging systems","name":"BD Rowa Pouch Packaging Systems","label":"bd rowa pouch packaging systems","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All","noFixRecorded":false,"fixedIn":null}],"versionsText":"All","eol":null,"hubHref":"/vendor/becton_dickinson_bd/bd_rowa_pouch_packaging_systems"}],"affectedCount":24,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products---hardcoded-credentials","label":"cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products---hardcoded-credentials","hostname":"cybersecurity.bd.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01","label":"www.cisa.gov/uscert/ics/advisories/icsma-22-062-01","hostname":"www.cisa.gov","tags":["X Refsource MISC","Third Party Advisory","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-02-11T18:12:07.247Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T19:15:26.998Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T20:04:59.357Z","stale":false,"partial":false}}