CVE-2022-22766
Last modified
CVE-2022-22766 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bd | Pyxis Anesthesia Station Es Firmware | All versions |
| Bd | Pyxis Anesthesia Station 4000 Firmware | All versions |
| Bd | Pyxis Cato Firmware | All versions |
| Bd | Pyxis Ciisafe Firmware | All versions |
| Bd | Pyxis Inventory Connect Firmware | All versions |
| Bd | Pyxis Iv Prep Firmware | All versions |
| Bd | Pyxis Jitrbud Firmware | All versions |
| Bd | Pyxis Kanban Rf Firmware | All versions |
| Bd | Pyxis Logistics Firmware | All versions |
| Bd | Pyxis Med Link Family Firmware | All versions |
| Bd | Pyxis Medbank Firmware | All versions |
| Bd | Pyxis Medstation 4000 Firmware | All versions |
| Bd | Pyxis Medstation Es Firmware | All versions |
| Bd | Pyxis Medstation Es Server Firmware | All versions |
| Bd | Pyxis Parassist Firmware | All versions |
| Bd | Pyxis Pharmopack Firmware | All versions |
| Bd | Pyxis Procedurestation Firmware | All versions |
| Bd | Pyxis Rapid Rx Firmware | All versions |
| Bd | Pyxis Stockstation Firmware | All versions |
| Bd | Pyxis Supplycenter Firmware | All versions |
| Bd | Pyxis Supplyroller Firmware | All versions |
| Bd | Pyxis Supplystation Firmware | All versions |
| Bd | Pyxis Track And Deliver Firmware | All versions |
| Bd | Rowa Pouch Packaging Systems Firmware | All versions |
References
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01Third Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-22766?
How severe is CVE-2022-22766?
How do I fix CVE-2022-22766?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-22760When importing resources using Web Workers, error messages w…6.5
- CVE-2022-22761Web-accessible extension pages (pages with a moz-extension:/…8.8
- CVE-2022-22762Under certain circumstances, a JavaScript alert (or prompt) …4.3
- CVE-2022-22763When a worker is shutdown, it was possible to cause script t…8.8
- CVE-2022-22764Mozilla developers Paul Adenot and the Mozilla Fuzzing Team …8.8
- CVE-2022-22765BD Viper LT system, versions 2.0 and later, contains hardcod…7.8
- CVE-2022-22767Specific BD Pyxis™ products were installed with default cred…8.8
- CVE-2022-22769The Web server component of TIBCO Software Inc.'s TIBCO EBX,…9
- CVE-2022-2277Improper Input Validation vulnerability exists in the Hitach…7.5
- CVE-2022-22770The Web Server component of TIBCO Software Inc.'s TIBCO Audi…9.8
- CVE-2022-22771The Server component of TIBCO Software Inc.'s TIBCO JasperRe…8.8
- CVE-2022-22772The cfsend, cfrecv, and CyberResp components of TIBCO Softwa…7.5
Are you affected by CVE-2022-22766?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST