CVE-2023-30559

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-30559
The firmware update package for the wireless card is not properly signed and can be modified.

5.7 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 4.7

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:bd:alaris_8015_pcu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bd:alaris_8015_pcu:-:*:*:*:*:*:*:*
History

08 Feb 2024, 22:15

Type Values Removed Values Added
Summary The configuration from the PCU can be modified without authentication using physical connection to the PCU. The firmware update package for the wireless card is not properly signed and can be modified.

25 Jul 2023, 18:55

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.7
References (MISC) https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx - (MISC) https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx - Vendor Advisory
CWE CWE-287
CPE cpe:2.3:h:bd:alaris_8015_pcu:-:*:*:*:*:*:*:*
cpe:2.3:o:bd:alaris_8015_pcu_firmware:*:*:*:*:*:*:*:*
First Time Bd
Bd alaris 8015 Pcu Firmware
Bd alaris 8015 Pcu

13 Jul 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-13 18:15

Updated : 2024-02-08 22:15

NVD link : CVE-2023-30559

Mitre link : CVE-2023-30559

JSON object : View

Products Affected

bd

  • alaris_8015_pcu
  • alaris_8015_pcu_firmware
CWE
CWE-287

Improper Authentication