CVE-2015-3956

State: Published
Severity: Not scored
Published: Mar 25, 2019
Updated: Aug 6, 2024
Reserved: May 12, 2015

Description

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.

Scores

The record has no CVSS score.

Weaknesses

CWE-345 Insufficient verification of data authenticity CWE-345

Affected Products

Product	Versions
Plum A+ Infusion SystemHospira	<= 13.4Affected
Plum A+3 Infusion SystemHospira	<= 13.6Affected
Symbiq Infusion SystemHospira	<= 3.13Affected

References

https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.