CVE-2022-22767 BD Pyxis™ Products – Default Credentials
Attackers can use default credentials to gain privileged access to BD Pyxis medical devices, potentially exposing sensitive patient data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22767?
CVE-2022-22767 is a high-severity vulnerability in Becton Dickinson (BD) BD Pyxis™ Anesthesia ES Station, published on 1 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.
Which versions are affected by CVE-2022-22767?
It affects 16 products.
Products include Bd Pyxis Anesthesia Station Es Firmware, Bd Pyxis Ciisafe Firmware, Bd Pyxis Logistics Firmware, Bd Pyxis Medbank Firmware, Bd Pyxis Medstation 4000 Firmware, Bd Pyxis Medstation Es Firmware and 10 more.
How do I fix CVE-2022-22767?
No fix has been published for CVE-2022-22767 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-22767 being exploited?
There is no known exploitation of CVE-2022-22767 in the wild and no public exploit code.
Other vulnerabilities in Becton Dickinson (BD) BD Pyxis™ Anesthesia ES Station
Sources
Also known as GHSA-6qrf-f2g2-q6w9.