SQL injection in Becton, Dickinson and Company (BD) Kiestra and InoqulA systems
Priority LOW 28CWE-356Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data.
Why it matters now
EPSS 0.00407 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Becton, Dickinson and Company (BD) | Kiestra and InoqulA systems | Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor using ReadA Overview version 1.1.0.2 and previous. | — | No fix listed | CNA |
- Kiestra and InoqulA systems VendorBecton, Dickinson and Company (BD) Affected Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor using ReadA Overview version 1.1.0.2 and previous. Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bd:database_manager:3.0.1.0:*:*:*:*:*:*:* | 3.0.1.0 | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:a:bd:performa:*:*:*:*:*:*:*:* | up to 3.0.0.0 | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:a:bd:reada:*:*:*:*:*:*:*:* | up to 1.1.0.2 | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:inoqula\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:kiestra_tla:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:kiestra_wca:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
- cpe:2.3:a:bd:database_manager:3.0.1.0:*:*:*:*:*:*:* Versions 3.0.1.0 Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:a:bd:performa:*:*:*:*:*:*:*:* Versions up to 3.0.0.0 Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:a:bd:reada:*:*:*:*:*:*:*:* Versions up to 1.1.0.2 Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:inoqula\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:kiestra_tla:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:kiestra_wca:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-10595
- 2026-10-03 Alias added: GHSA-vjxw-9cfw-2hcr
References
More Becton, Dickinson and Company (BD) Database Manager vulnerabilities
- TI-2018-07482 SQL injection in Becton, Dickinson and Company (BD) Kiestra and InoqulA systems CVSS 3.0MEDIUM 5.6
Sources
- CVE-2018-10595 · CVE Program
- CVE-2018-10595 · NVD
- FIRST EPSS
- GHSA-vjxw-9cfw-2hcr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences