BD Alaris System with Guardrails Suite MX
In BD Alaris Point-of-Care Unit (PCU) Model 8015 v12.1.3 and prior, the firmware update package for the wireless card is not properly signed and can be modified. In BD Alaris Point-of-Care Unit (PCU) Model 8015 v12.1.3 and prior, the configuration from the PCU can be modified without authentication using physical connection to the PCU. In BD Alaris Point-of-Care Unit (PCU) Model 8015 v12.1.3 and prior, the data flowing between the PCU and its modules is insecure. A threat actor with physical access could read or modify data by attaching a specially crafted device while an infusion is running. BD Alaris Guardrails Editor (GRE) v12.1.2 and prior has a GRE dataset file within Systems Manager that can be tampered with and distributed to the PCUs. In the BD Alaris Systems Manager (SM) v12.3 and prior, a malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session. BD Alaris Systems Manager (SM) v12.3 and prior does not perform input validation during the Device Import Function. An insecure connection between Systems Manager and CQI Reporter v10.17 application could expose infusion data to an attacker. A lack of input validation within Apache Log4Net (due to an outdated software version) could allow a threat actor to execute malicious commands.