CVE-2022-43557

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-43557
The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 4.7

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-bodyguard-pumps-rs-232-interface-vulnerability Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:bd:bodyguard_999-603_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:bd:bodyguard_999-603:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:bd:bodyguard_duo_999-903_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:bd:bodyguard_duo_999-903:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:bd:bodyguard_epidural_999-683_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:bd:bodyguard_epidural_999-683:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:bd:bodyguard_pain_manager_999-803_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:bd:bodyguard_pain_manager_999-803:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:bd:bodyguard_t_999-103_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:bd:bodyguard_t_999-103:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:bd:bodyguard_323_colorvision_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:bd:bodyguard_323_colorvision:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:bd:bodyguard_121_twins_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:bd:bodyguard_121_twins:-:*:*:*:*:*:*:*
History

27 Oct 2023, 21:15

Type Values Removed Values Added
Summary The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump. The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump.
Information

Published : 2022-12-05 22:15

Updated : 2023-10-27 21:15

NVD link : CVE-2022-43557

Mitre link : CVE-2022-43557

JSON object : View

Products Affected

bd

  • bodyguard_epidural_999-683_firmware
  • bodyguard_121_twins_firmware
  • bodyguard_pain_manager_999-803
  • bodyguard_999-603
  • bodyguard_duo_999-903
  • bodyguard_323_colorvision
  • bodyguard_121_twins
  • bodyguard_duo_999-903_firmware
  • bodyguard_pain_manager_999-803_firmware
  • bodyguard_323_colorvision_firmware
  • bodyguard_epidural_999-683
  • bodyguard_t_999-103_firmware
  • bodyguard_t_999-103
  • bodyguard_999-603_firmware
CWE
CWE-287

Improper Authentication