Multiple Hospira Products CVE-2015-3952 Information Disclosure Vulnerability

Bugtraq ID:	75134
Class:	Input Validation Error
CVE:	CVE-2015-3952
Remote:	Yes
Local:	No
Published:	Jun 11 2015 12:00AM
Updated:	Jun 11 2015 12:00AM
Credit:	Billy Rios
Vulnerable:	Hospira Symbiq Infusion System 3.13 Hospira Plum A+3 Infusion System 13.6 Hospira Plum A+ Infusion System 13.4
Not Vulnerable:

Multiple Hospira Products CVE-2015-3952 Information Disclosure Vulnerability

Multiple Hospira products are prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

The following products are available:

Plum A+ Infusion System 13.4 and prior
Plum A+3 Infusion System 13.6 and prior
Symbiq Infusion System 3.13 and prior

Multiple Hospira Products CVE-2015-3952 Information Disclosure Vulnerability

Attackers can use readily available tools to exploit this issue.

Multiple Hospira Products CVE-2015-3952 Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Multiple Hospira Products CVE-2015-3952 Information Disclosure Vulnerability

References:

• Hospira Home Page (Hospira)
  
• Hospira Plum A+ and Symbiq Infusion Systems Vulnerabilities (ICS CERT)