CVE-2014-5405

Hospira MedNet Use of Hard-coded Password

State: Published
Severity: 9.0 High
Published: Apr 3, 2015
Updated: Nov 3, 2025
Reserved: Aug 22, 2014

Description

Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.

Scores

CVSS	Score	Vector	Source
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C	icscert

Weaknesses

CWE-259

Affected Products

Product	Versions
MedNetHospira	5.8 and earlierAffected 6.1Not affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-15-090-03
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-090-03.json
https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.