CVE-2020-10598 Security feature bypass in Pyxis Anesthesia (PAS) ES System
Attackers can escape the restricted kiosk mode on BD Pyxis systems to access sensitive data, impacting medical device security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10598?
CVE-2020-10598 is a medium-severity vulnerability in Becton, Dickinson and Company (BD) Pyxis Anesthesia (PAS) ES System, published on 1 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices. Specially crafted inputs could allow the user to escape the restricted environment, resulting in access to sensitive data.
Weakness: CWE-693
Which versions are affected by CVE-2020-10598?
It affects 2 products.
Products include Bd Pyxis Anesthesia Station Es Firmware, Bd Pyxis Medstation Es Firmware.
How do I fix CVE-2020-10598?
No fix has been published for CVE-2020-10598 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10598 being exploited?
There is no known exploitation of CVE-2020-10598 in the wild and no public exploit code.
Other vulnerabilities in Becton, Dickinson and Company (BD) Pyxis Anesthesia (PAS) ES System
Sources
Also known as GHSA-fqjr-2cv5-p732.