CVE-2016-9355: An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An...

Description

An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience.

Metrics

EPSS Probability

0.51%

39.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-255

Affected Software

Vendor	Product	Versions
Bd	Alaris 8015 Pc Unit	<= 9.5
Bd	Alaris 8015 Pc Unit	9.7

References

http://www.securityfocus.com/bid/96116Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/96116Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Feb 13, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-9355?

An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience.

How severe is CVE-2016-9355?

Severity scoring for CVE-2016-9355 is pending analysis. The EPSS model estimates a 0.51% probability of exploitation in the next 30 days.

How do I fix CVE-2016-9355?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2016

View all 2016CVEs →