Vulnerability Details : CVE-2022-43557
The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump.
Vulnerability category: BypassGain privilege
Products affected by CVE-2022-43557
- cpe:2.3:o:bd:bodyguard_999-603_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:bd:bodyguard_duo_999-903_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:bd:bodyguard_epidural_999-683_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:bd:bodyguard_pain_manager_999-803_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:bd:bodyguard_t_999-103_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:bd:bodyguard_323_colorvision_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:bd:bodyguard_121_twins_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-43557
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 29 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-43557
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H |
0.5
|
4.7
|
Becton, Dickinson and Company (BD) | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H |
0.5
|
4.7
|
NIST |
CWE ids for CVE-2022-43557
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
-
The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path.Assigned by: cybersecurity@bd.com (Secondary)
References for CVE-2022-43557
-
https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-bodyguard-pumps-rs-232-interface-vulnerability
BD BodyGuard™ Pumps – RS-232 Interface VulnerabilityMitigation;Vendor Advisory
Jump to