CVE-2015-3952

State: Published
Severity: Not scored
Published: Mar 25, 2019
Updated: Aug 6, 2024
Reserved: May 12, 2015

Description

Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.

Scores

The record has no CVSS score.

Weaknesses

CWE-312 Cleartext storage of sensitive information CWE-312

Affected Products

Product	Versions
Plum A+ Infusion SystemHospira	<= 13.4Affected
Plum A+3 Infusion SystemHospira	<= 13.6Affected
Symbiq Infusion SystemHospira	<= 3.13Affected

References

https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.