CVE-2014-5406

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port. NOTE: this issue might overlap CVE-2015-3459.

• CWE-345
• CWE-345

• http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htmThird Party Advisory, US Government Resource
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-125-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-15-125-01
• https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/
• http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htmThird Party Advisory, US Government Resource
• https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01Third Party Advisory, US Government Resource
• https://xs-sniper.com/blog/2015/06/08/hospira-plum-a-infusion-pump-vulnerabilities/

Published

Jul 6, 2015

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-5400The installation component in Hospira MedNet before 6.1 plac…
• CVE-2014-5401Hospira MedNet software version 5.8 and prior uses vulnerabl…
• CVE-2014-5402Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-5403Hospira MedNet before 6.1 uses hardcoded cryptographic keys …
• CVE-2014-5404Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-5405Hospira MedNet before 6.1 uses a hardcoded cleartext passwor…
• CVE-2014-5407Multiple stack-based buffer overflows in Schneider Electric …
• CVE-2014-5408Cross-site scripting (XSS) vulnerability in the login script…
• CVE-2014-5409The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL fo…
• CVE-2014-5410The DNP3 feature on Rockwell Automation Allen-Bradley MicroL…
• CVE-2014-5411Multiple cross-site scripting (XSS) vulnerabilities in Schne…
• CVE-2014-5412Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010…