What is the CVSS score of CVE-2022-43557?

CVE-2022-43557 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.2%.

Bodyguard 999 603 Firmware CVE-2022-43557

MEDIUM

Missing Protection Mechanism for Alternate Hardware Interface (CWE-1299)

2022-12-05 cybersecurity@bd.com

Information Disclosure Bodyguard 999 603 Firmware Bodyguard Duo 999 903 Firmware Bodyguard Epidural 999 683 Firmware Bodyguard Pain Manager 999 803 Firmware Bodyguard T 999 103 Firmware Bodyguard 323 Colorvision Firmware Bodyguard 121 Twins Firmware

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

CVE Published

Dec 05, 2022 - 22:15 nvd

MEDIUM 5.3

DescriptionNVD

The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump.

AnalysisAI

The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1299. The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump. Affected products include: Bd Bodyguard 999-603 Firmware, Bd Bodyguard Duo 999-903 Firmware, Bd Bodyguard Epidural 999-683 Firmware, Bd Bodyguard Pain Manager 999-803 Firmware, Bd Bodyguard T 999-103 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.