CVE-2024-10476: becton dickinson & co bd bactec™ blood culture system Use of Default Credentials

Vulnerability summary

CVE-2024-10476 is a high (CVSS 8.0) Use of Default Credentials vulnerability in becton dickinson & co bd bactec™ blood culture system. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.7% of scored vulnerabilities.

Timeline

1. 17-12-2024
   PublishedVulnerability first disclosed.
2. 17-12-2024
   Last modifiedVulnerability information updated.

Description

Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and personally identifiable information (PII). Exploitation of this vulnerability may allow an attacker to shut down or otherwise impact the availability of the system. Note: BD Synapsys™ Informatics Solution is only in scope of this vulnerability when installed on a NUC server. BD Synapsys™ Informatics Solution installed on a customer-provided virtual machine or on the BD Kiestra™ SCU hardware is not in scope.

• CWE-1392Use of Default CredentialsThe product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.