SQL injection in Becton, Dickinson and Company (BD) Kiestra and InoqulA systems
Priority LOW 25CWE-356Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corruption.
Why it matters now
EPSS 0.00361 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Becton, Dickinson and Company (BD) | Kiestra and InoqulA systems | Kiestra TLA, BD Kiestra WCA, and BD InoqulA+ specimen processor using Database (DB) Manager version 3.0.1.0, and previous, and PerformA version 3.0.0.0 and previous. | — | No fix listed | CNA |
- Kiestra and InoqulA systems VendorBecton, Dickinson and Company (BD) Affected Kiestra TLA, BD Kiestra WCA, and BD InoqulA+ specimen processor using Database (DB) Manager version 3.0.1.0, and previous, and PerformA version 3.0.0.0 and previous. Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bd:database_manager:3.0.1.0:*:*:*:*:*:*:* | 3.0.1.0 | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:a:bd:performa:*:*:*:*:*:*:*:* | up to 3.0.0.0 | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:a:bd:reada:*:*:*:*:*:*:*:* | up to 1.1.0.2 | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:inoqula\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:kiestra_tla:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:kiestra_wca:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
- cpe:2.3:a:bd:database_manager:3.0.1.0:*:*:*:*:*:*:* Versions 3.0.1.0 Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:a:bd:performa:*:*:*:*:*:*:*:* Versions up to 3.0.0.0 Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:a:bd:reada:*:*:*:*:*:*:*:* Versions up to 1.1.0.2 Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:inoqula\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:kiestra_tla:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:kiestra_wca:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-10593
- 2026-10-03 Alias added: GHSA-gjwf-hgg5-m3rx
References
More Becton, Dickinson and Company (BD) Database Manager vulnerabilities
- TI-2018-07484 SQL injection in Becton, Dickinson and Company (BD) Kiestra and InoqulA systems CVSS 3.0MEDIUM 6.3
Sources
- CVE-2018-10593 · CVE Program
- CVE-2018-10593 · NVD
- FIRST EPSS
- GHSA-gjwf-hgg5-m3rx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences