CVE-2019-10959 : BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 B

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.

Published 2019-06-13 21:29:16

Updated 2019-10-09 23:45:06

Source ICS-CERT

View at NVD, CVE.org

Products affected by CVE-2019-10959

BD » Alaris Gateway Workstation Firmware » Version: 1.3.0 Update 14
cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.3.0:14:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Gateway Workstation » Version: N/A
BD » Alaris Gateway Workstation Firmware » Version: 1.3.1 Update 13
cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.3.1:13:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Gateway Workstation » Version: N/A
BD » Alaris Gateway Workstation Firmware » Version: 1.1.3 Update 11
cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:11:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Gateway Workstation » Version: N/A
BD » Alaris Gateway Workstation Firmware » Version: 1.1.3 Update 10
cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:10:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Gateway Workstation » Version: N/A
BD » Alaris Gateway Workstation Firmware » Version: 1.2 Update 15
cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.2:15:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Gateway Workstation » Version: N/A
BD » Alaris Gs Syringe Pump Firmware
Versions up to, including, (<=) 2.3.6
cpe:2.3:o:bd:alaris_gs_syringe_pump_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Gs Syringe Pump » Version: N/A
BD » Alaris Gh Syringe Pump Firmware
Versions up to, including, (<=) 2.3.6
cpe:2.3:o:bd:alaris_gh_syringe_pump_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Gh Syringe Pump » Version: N/A
BD » Alaris Cc Syringe Pump Firmware
Versions up to, including, (<=) 2.3.6
cpe:2.3:o:bd:alaris_cc_syringe_pump_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Cc Syringe Pump » Version: N/A
BD » Alaris Tiva Syringe Pump Firmware
Versions up to, including, (<=) 2.3.6
cpe:2.3:o:bd:alaris_tiva_syringe_pump_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: BD » Alaris Tiva Syringe Pump » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-10959

EPSS FAQ

0.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 58 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-10959

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
10.0	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-10959

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Assigned by:
- ics-cert@hq.dhs.gov (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2019-10959

https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01

BD Alaris Gateway Workstation | CISA
Mitigation;Third Party Advisory;US Government Resource

CVEs referencing this url
http://www.securityfocus.com/bid/108765

BD Alaris Gateway Workstation CVE-2019-10959 Arbitrary File Upload Vulnerability
Third Party Advisory;VDB Entry
https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/alaris-gateway-workstation-unauthorized-firmware

Alaris™ Gateway Workstation Unauthorized Firmware - BD
Vendor Advisory

Jump to

Vulnerability Details : CVE-2019-10959

Products affected by CVE-2019-10959

Exploit prediction scoring system (EPSS) score for CVE-2019-10959

CVSS scores for CVE-2019-10959

CWE ids for CVE-2019-10959

References for CVE-2019-10959