Read the docs
TI-2014-04404 Aliases CVE-2014-5403GHSA-7fj9-wg8v-v4f2

Hospira MedNet Use of Hard-coded Cryptographic Key

Priority LOW 34CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.

Why it matters now

EPSS 0.01744 77th percentileScored 2026-11-07
Fix Fixed MedNet (Hospira): 6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HospiraMedNetup to 5.86.1Patch availableCNA
  • MedNet VendorHospira Affected up to 5.8 Fixed in 6.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hospira:mednet:*:*:*:*:*:*:*:*up to 5.8VulnerableHospira
  • cpe:2.3:a:hospira:mednet:*:*:*:*:*:*:*:* Versions up to 5.8 Vulnerable ·Hospira

Remediation

  • Fix · CNA MedNet (Hospira) Fixed in 6.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-5403
  2. 2026-10-03 Alias added: GHSA-7fj9-wg8v-v4f2

References

Advisory 1

Other 2

  • TI-2014-04403 Hospira MedNet Code Injection CVSS 3.0CRITICAL 9.8
  • TI-2014-04405 Hospira MedNet Use of Hard-coded Password CVSS 2.0CRITICAL 9.0
  • TI-2014-04402 Hospira MedNet Password in Configuration File CVSS 2.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences