CVE-2020-25165

BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a network session authentication vulnerability within the authentication process between specified versions of the BD Alaris PC Unit and the BD Alaris Systems Manager. If exploited, an attacker could perform a denial-of-service attack on the BD Alaris PC Unit by modifying the configuration headers of data in transit. A denial-of-service attack could lead to a drop in the wireless capability of the BD Alaris PC Unit, resulting in manual operation of the PC Unit.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsma-20-317-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:bd:alaris_8015_pcu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:bd:alaris_8015_pcu:-:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:bd:alaris_systems_manager:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-11-13 16:15

Updated : 2024-02-04 21:23

NVD link : CVE-2020-25165

Mitre link : CVE-2020-25165

CVE.ORG link : CVE-2020-25165

JSON object : View

Products Affected

bd

alaris_systems_manager
alaris_8015_pcu
alaris_8015_pcu_firmware

CWE

CWE-287

Improper Authentication

{"id": "CVE-2020-25165", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-11-13T16:15:18.027", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-317-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a network session authentication vulnerability within the authentication process between specified versions of the BD Alaris PC Unit and the BD Alaris Systems Manager. If exploited, an attacker could perform a denial-of-service attack on the BD Alaris PC Unit by modifying the configuration headers of data in transit. A denial-of-service attack could lead to a drop in the wireless capability of the BD Alaris PC Unit, resulting in manual operation of the PC Unit."}, {"lang": "es", "value": "BD Alaris PC Unit, Model 8015, versiones 9.33.1 y anteriores y BD Alaris Systems Manager, versiones 4.33 y anteriores Los productos afectados son susceptibles a una vulnerabilidad de autenticaci\u00f3n de sesi\u00f3n de red dentro del proceso de autenticaci\u00f3n entre versiones especificadas del BD Alaris PC Unit y del BD Alaris Systems Manager. Si es explotado, un atacante podr\u00eda llevar a cabo un ataque de denegaci\u00f3n de servicio en el BD Alaris PC Unit para modificar unos encabezados de configuraci\u00f3n de los datos en tr\u00e1nsito. Un ataque de denegaci\u00f3n de servicio podr\u00eda conllevar a una perdida en la capacidad inal\u00e1mbrica del BD Alaris PC Unit, resultando en el funcionamiento manual del PC Unit"}], "lastModified": "2020-12-03T14:18:38.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bd:alaris_8015_pcu_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B3B2243-0B6E-46C4-8F55-C18179DE4A24", "versionEndIncluding": "9.33.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bd:alaris_8015_pcu:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5909B9D0-07A7-4AA1-8FF4-CE6DEBCE14DA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bd:alaris_systems_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E184AA1-0325-46A1-83F4-4299C71F9940", "versionEndIncluding": "4.33"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}