{"schemaVersion":3,"id":"CVE-2022-43557","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump.","dates":{"published":"2022-12-05T00:00:00.000Z","modified":"2025-04-23T15:47:10.734Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00224,"percentile":0.12297,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00224},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00218,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00224,"percentile":0.12297}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00224,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00224,"percentile":0.12297}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1299","name":"Missing Protection Mechanism for Alternate Hardware Interface","description":"The lack of protections on alternate paths to access\n                control-protected assets (such as unprotected shadow registers\n                and other external facing unguarded interfaces) allows an\n                attacker to bypass existing protections to the asset that are\n\t\tonly performed against the primary path.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1299.html"},{"id":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/287.html"}],"affected":[{"vendor":"bd","product":"bodyguard_121_twins_firmware","name":"bodyguard 121 twins firmware","label":"bodyguard_121_twins_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/bd/bodyguard_121_twins"},{"vendor":"bd","product":"bodyguard_323_colorvision_firmware","name":"bodyguard 323 colorvision firmware","label":"bodyguard_323_colorvision_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/bd/bodyguard_323_colorvision"},{"vendor":"bd","product":"bodyguard_999-603_firmware","name":"bodyguard 999-603 firmware","label":"bodyguard_999-603_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/bd/bodyguard_999-603"},{"vendor":"bd","product":"bodyguard_duo_999-903_firmware","name":"bodyguard duo 999-903 firmware","label":"bodyguard_duo_999-903_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/bd/bodyguard_duo_999-903"},{"vendor":"bd","product":"bodyguard_epidural_999-683_firmware","name":"bodyguard epidural 999-683 firmware","label":"bodyguard_epidural_999-683_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/bd/bodyguard_epidural_999-683"},{"vendor":"bd","product":"bodyguard_pain_manager_999-803_firmware","name":"bodyguard pain manager 999-803 firmware","label":"bodyguard_pain_manager_999-803_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/bd/bodyguard_pain_manager_999-803"},{"vendor":"bd","product":"bodyguard_t_999-103_firmware","name":"bodyguard t 999-103 firmware","label":"bodyguard_t_999-103_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/bd/bodyguard_t_999-103"},{"vendor":"becton, dickinson and company (bd)","product":"bodyguard™ pump","name":"BodyGuard™ Pump","label":"bodyguard™ pump","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"BD BodyGuard™","noFixRecorded":false,"fixedIn":null},{"text":"CME BodyGuard™ 323 (2nd Edition)","noFixRecorded":false,"fixedIn":null},{"text":"CME BodyGuard™ 323 Color Vision (2nd Edition)","noFixRecorded":false,"fixedIn":null},{"text":"CME BodyGuard™ 323 Color Vision (3rd Edition)","noFixRecorded":false,"fixedIn":null},{"text":"CME BodyGuard™ Twins (2nd Edition)","noFixRecorded":false,"fixedIn":null}],"versionsText":"BD BodyGuard™ | CME BodyGuard™ 323 (2nd Edition) | CME BodyGuard™ 323 Color Vision (2nd Edition) | CME BodyGuard™ 323 Color Vision (3rd Edition) | CME BodyGuard™ Twins (2nd Edition)","eol":null,"hubHref":"/vendor/becton_dickinson_and_company_bd/bodyguardTM_pump"}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-bodyguard-pumps-rs-232-interface-vulnerability","label":"www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-bodyguard-pumps-rs-232-interface-vulnerability","hostname":"www.bd.com","tags":["Vendor Advisory","Mitigation"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-12-05T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-04-23T15:47:10.734Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T10:22:49.283Z","stale":false,"partial":false}}