CVE-2019-10959

high-risk

Published 2019-06-13

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.

Do I need to act?

1.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 10.0/10 Critical

NETWORK / LOW complexity

Affected Products (9)

Alaris Gateway Workstation Firmware

Alaris Gs Syringe Pump Firmware

Alaris Gh Syringe Pump Firmware

Alaris Cc Syringe Pump Firmware

Alaris Tiva Syringe Pump Firmware

Affected Vendors

References (5)

Third Party Advisory http://www.securityfocus.com/bid/108765

Mitigation https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01

Vendor Advisory https://www.bd.com/en-us/support/product-security-and-privacy/product-security-b...

Third Party Advisory http://www.securityfocus.com/bid/108765

Mitigation https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01

/ 100

high-risk

Severity 33/34 · Critical

Exploitability 3/34 · Minimal

Exposure 15/34 · Moderate