Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-10959

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.

Published

2019-06-13T21:29:15.817

Last Modified

2024-11-21T04:20:14.217

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 10.0 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-434
  • Type: Primary
    CWE-434
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System bd alaris_gateway_workstation_firmware 1.1.3 Yes
Operating System bd alaris_gateway_workstation_firmware 1.1.3 Yes
Operating System bd alaris_gateway_workstation_firmware 1.2 Yes
Operating System bd alaris_gateway_workstation_firmware 1.3.0 Yes
Operating System bd alaris_gateway_workstation_firmware 1.3.1 Yes
Hardware bd alaris_gateway_workstation - No
Operating System bd alaris_gs_syringe_pump_firmware ≤ 2.3.6 Yes
Hardware bd alaris_gs_syringe_pump - No
Operating System bd alaris_gh_syringe_pump_firmware ≤ 2.3.6 Yes
Hardware bd alaris_gh_syringe_pump - No
Operating System bd alaris_cc_syringe_pump_firmware ≤ 2.3.6 Yes
Hardware bd alaris_cc_syringe_pump - No
Operating System bd alaris_tiva_syringe_pump_firmware ≤ 2.3.6 Yes
Hardware bd alaris_tiva_syringe_pump - No
References