CVE-2022-22766

Summary

Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.

Affected Software

Weaknesses

• CWE-798: CWE-798 Use of Hard-coded Credentials

Workarounds

Limit physical access to the device to only authorized personnel. Tightly control management of BD Pyxis system credentials provided to authorized users. Isolate affected products in a secure VLAN or behind firewalls with restricted access that only permits communication with trusted hosts in other networks when needed. Monitor and log all network traffic attempting to reach the affected products for suspicious activity. Work with your local BD support team ensure all patching and virus definitions are up to date. The Pyxis Security Module for automated patching and virus definition management is provided to all accounts.

ADP Enrichment

CVE Program Container

Additional References

• https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products—hardcoded-credentials
• https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01

References

• https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products—hardcoded-credentials
• https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01

• ←Previous
• Next→