- 7.6HighCVSS base score
- 1.2%Exploitation in 30 daysEPSS · top 31% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port. NOTE: this issue might overlap CVE-2015-3459.
Timeline
ID reserved
By icscert
- 11 months later
· 11 months later
Published
- 10 years later
· 10 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | High7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
| NVDNVD · Modified | 2.0 | High9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 1.2% · top 31% of all CVEs (10 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.
Affected products
Hospira · LifeCare PCA Infusion System
- affected ≤ 5.0
- unaffected 7.0
What to do
Solution: ICS-CERT has been working with Hospira since May 2014 to address the vulnerabilities in the LifeCare PCA Infusion System. Hospira has developed a new version of the PCS Infusion System, Version 7.0 that addresses the identified vulnerabilities. According to Hospira, Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access. Existing PCA Infusion Systems running Version 5.0 can be upgraded to Version 7.0 when it becomes available. Hospira’s Version 7.0 is being reviewed by the FDA prior to its release. The release date for Version 7.0 of the LifeCare PCA Infusion System has not been determined. For additional information about Hospira’s new release, contact Hospira’s technical support at 1‑800-241-4002.
References
5
- https://www.cisa.gov/news-events/ics-advisories/icsa-15-125-01 (opens in a new tab)
- http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm (opens in a new tab)x_refsource_MISCx_transferred
- https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/ (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-125-01.json (opens in a new tab)
- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2014-5294 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2014-5406)Record last updated .