CVE-2015-3953
Critical
Description
Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductPifzer Plum A\+ Infusion System Firmware
PublishedMar 25, 2019
First seenMar 25, 2019
Weakness typeCWE-259CWE-259
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pifzer plum_a\+_infusion_system_firmware | v ≤ 13.4 | — |
| pifzer plum_a\+3_infusion_system_firmware | v ≤ 13.6 | — |
| pifzer symbiq_infusion_system_firmware | v ≤ 3.13 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.