{"api_version":"1","generated_at":"2026-07-23T08:49:35+00:00","cve":"CVE-2015-3459","urls":{"html":"https://cve.report/CVE-2015-3459","api":"https://cve.report/api/cve/CVE-2015-3459.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-3459","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3459"},"summary":{"title":"CVE-2015-3459","description":"The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-04-29 23:59:00","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.securityfocus.com/bid/74414","name":"http://www.securityfocus.com/bid/74414","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Hospira Lifecare PCA Infusion Pump CVE-2015-3459 Authentication Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm","name":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"Vulnerabilities of Hospira LifeCare PCA3 and PCA5 Infusion Pump Systems: FDA Safety Communication","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://imgur.com/JHiWSqd","name":"http://imgur.com/JHiWSqd","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"],"title":"Imgur: The most awesome images on the Internet","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://twitter.com/dyngnosis/status/592671049487142913","name":"https://twitter.com/dyngnosis/status/592671049487142913","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Press/Media Coverage"],"title":"dyngnosis on Twitter: \"Don't buy a Hospira PCA drug  pump to do security stuff.  Busybx no passwd shell on 23, no-auth CGIs, also never hook it up to a human being\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://imgur.com/CEAnZjj","name":"http://imgur.com/CEAnZjj","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"],"title":"Imgur: The most awesome images on the Internet","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://twitter.com/dyngnosis/status/592743461977219072","name":"https://twitter.com/dyngnosis/status/592743461977219072","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Press/Media Coverage"],"title":"dyngnosis on Twitter: \"@SushiDude @XSSniper @scotterven @WIRED Hospira \"Lifecare PCA Drug Infusion Pump\" http://t.co/JjAVF3J9KO SW ver 412 http://t.co/rSS0gqtfby\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01","name":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"Hospira LifeCare PCA Infusion System Vulnerabilities (Update B) | ICS-CERT","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"http://hextechsecurity.com/?p=123","name":"http://hextechsecurity.com/?p=123","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Hospira PCA3 Drug Infusion Pump | 0xTech Security","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3459","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3459","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"3459","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"hospira","cpe5":"lifecare_pca3","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3459","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"hospira","cpe5":"lifecare_pca5","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3459","vulnerable":"1","versionEndIncluding":"5.0","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"hospira","cpe5":"lifecare_pcainfusion_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:47:57.892Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://imgur.com/JHiWSqd"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://twitter.com/dyngnosis/status/592671049487142913"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://hextechsecurity.com/?p=123"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://twitter.com/dyngnosis/status/592743461977219072"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://imgur.com/CEAnZjj"},{"name":"74414","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/74414"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-04-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-30T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01"},{"tags":["x_refsource_MISC"],"url":"http://imgur.com/JHiWSqd"},{"tags":["x_refsource_MISC"],"url":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm"},{"tags":["x_refsource_MISC"],"url":"https://twitter.com/dyngnosis/status/592671049487142913"},{"tags":["x_refsource_MISC"],"url":"http://hextechsecurity.com/?p=123"},{"tags":["x_refsource_MISC"],"url":"https://twitter.com/dyngnosis/status/592743461977219072"},{"tags":["x_refsource_MISC"],"url":"http://imgur.com/CEAnZjj"},{"name":"74414","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/74414"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-3459","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01"},{"name":"http://imgur.com/JHiWSqd","refsource":"MISC","url":"http://imgur.com/JHiWSqd"},{"name":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm","refsource":"MISC","url":"http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm"},{"name":"https://twitter.com/dyngnosis/status/592671049487142913","refsource":"MISC","url":"https://twitter.com/dyngnosis/status/592671049487142913"},{"name":"http://hextechsecurity.com/?p=123","refsource":"MISC","url":"http://hextechsecurity.com/?p=123"},{"name":"https://twitter.com/dyngnosis/status/592743461977219072","refsource":"MISC","url":"https://twitter.com/dyngnosis/status/592743461977219072"},{"name":"http://imgur.com/CEAnZjj","refsource":"MISC","url":"http://imgur.com/CEAnZjj"},{"name":"74414","refsource":"BID","url":"http://www.securityfocus.com/bid/74414"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-3459","datePublished":"2015-04-29T23:00:00.000Z","dateReserved":"2015-04-29T00:00:00.000Z","dateUpdated":"2024-08-06T05:47:57.892Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-04-29 23:59:00","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:hospira:lifecare_pcainfusion_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"5.0","matchCriteriaId":"6EF8A9BC-9349-4A57-A7B7-63640A066189"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:hospira:lifecare_pca3:-:*:*:*:*:*:*:*","matchCriteriaId":"86AC1C1C-D9FC-4EEE-B1A6-CEB03351EA58"},{"vulnerable":true,"criteria":"cpe:2.3:h:hospira:lifecare_pca5:-:*:*:*:*:*:*:*","matchCriteriaId":"C3551213-7D88-43AC-B56A-50F063884258"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"3459","Ordinal":"1","Title":"CVE-2015-3459","CVE":"CVE-2015-3459","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"3459","Ordinal":"1","NoteData":"The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.","Type":"Description","Title":"CVE-2015-3459"},{"CveYear":"2015","CveId":"3459","Ordinal":"2","NoteData":"2015-04-29","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"3459","Ordinal":"3","NoteData":"2016-12-30","Type":"Other","Title":"Modified"}]}}}