CVE-2015-3459

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

5.06%

Published

Apr 29, 2015

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.

Weaknesses (CWE)

CWE-264

Affected Products (3)

hospira · lifecare_pcainfusion_firmwarevulnerable

hospira · lifecare_pca3vulnerable

hospira · lifecare_pca5vulnerable

References (16)

http://hextechsecurity.com/?p=123

Broken Link

http://imgur.com/CEAnZjj

Not Applicable

http://imgur.com/JHiWSqd

Not Applicable

http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/74414

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01

Third Party AdvisoryUS Government Resource

https://twitter.com/dyngnosis/status/592671049487142913

Press/Media Coverage

https://twitter.com/dyngnosis/status/592743461977219072

Press/Media Coverage

http://hextechsecurity.com/?p=123

Broken Link

http://imgur.com/CEAnZjj

Not Applicable

http://imgur.com/JHiWSqd

Not Applicable

http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/74414

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01

Third Party AdvisoryUS Government Resource

https://twitter.com/dyngnosis/status/592671049487142913

Press/Media Coverage

https://twitter.com/dyngnosis/status/592743461977219072

Press/Media Coverage

KEV Catalog EPSS Scores Vendors All CVEs