Read the docs
TI-2015-00924 Aliases CVE-2015-1012GHSA-82mj-h4mj-5q4v

Cleartext storage of sensitive information in Hospira LifeCare PCA Infusion System

Priority LOW 34CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-312.

Summary

Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access.

Why it matters now

EPSS 0.00771 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HospiraLifeCare PCA Infusion Systemup to 5.0—No fix listedCNA
  • LifeCare PCA Infusion System VendorHospira Affected up to 5.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:pfizer:lifecare_pca_infusion_system_firmware:*:*:*:*:*:*:*:*up to 5.0VulnerablePfizer
cpe:2.3:h:pfizer:lifecare_pca_infusion_system:-:*:*:*:*:*:*:*not specified by NVDRunning onPfizer
  • cpe:2.3:o:pfizer:lifecare_pca_infusion_system_firmware:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Pfizer
  • cpe:2.3:h:pfizer:lifecare_pca_infusion_system:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pfizer

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-1012
  2. 2026-10-03 Alias added: GHSA-82mj-h4mj-5q4v

References

Advisory 1

  • TI-2015-03341 Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and… CVSS 2.0HIGH 10.0
  • TI-2015-03050 The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not… CVSS 2.0HIGH 10.0
  • TI-2014-04403 Hospira MedNet Code Injection CVSS 3.0CRITICAL 9.8
  • TI-2015-03340 Improper authorization in Hospira Plum A+ Infusion System CVSS 3.0CRITICAL 9.8
  • TI-2015-03339 Hard-coded credentials in Hospira Plum A+ Infusion System CVSS 3.0CRITICAL 9.8
  • TI-2015-03342 Insufficient verification of data authenticity in Hospira Plum A+ Infusion System CVSS 3.0CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences