BD Pyxis Products - Hardcoded Credentials
Priority LOW 30CWE-798Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
Why it matters now
EPSS 0.00228 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Becton, Dickinson and Company (BD) | BD Pyxis Anesthesia Station ES | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis Anesthesia Station 4000 | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis CATO | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis CIISafe | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis Inventory Connect | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis IV Prep | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis JITrBUD | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis KanBan RF | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis Logistics | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis Med Link Family | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis MedBank | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis MedStation 4000 | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis MedStation ES | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis MedStation ES Server | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis ParAssist | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis PharmoPack | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis ProcedureStation (including EC) | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis Rapid Rx | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis StockStation | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis SupplyCenter | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis SupplyRoller | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis SupplyStation (including RF, EC, CP) | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis Track and Deliver | All | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Rowa Pouch Packaging Systems | All | — | No fix listed | CNA |
- BD Pyxis Anesthesia Station ES VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis Anesthesia Station 4000 VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis CATO VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis CIISafe VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis Inventory Connect VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis IV Prep VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis JITrBUD VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis KanBan RF VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis Logistics VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis Med Link Family VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis MedBank VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis MedStation 4000 VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis MedStation ES VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis MedStation ES Server VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis ParAssist VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis PharmoPack VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis ProcedureStation (including EC) VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis Rapid Rx VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis StockStation VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis SupplyCenter VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis SupplyRoller VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis SupplyStation (including RF, EC, CP) VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Pyxis Track and Deliver VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
- BD Rowa Pouch Packaging Systems VendorBecton, Dickinson and Company (BD) Affected All Fixed in — No fix listed CNA
CPE configurations NVD · 48
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bd:pyxis_anesthesia_station_es_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_anesthesia_station_es:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_anesthesia_station_4000_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_anesthesia_station_4000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_cato_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_cato:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_ciisafe_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_ciisafe:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_inventory_connect_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_inventory_connect:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
- cpe:2.3:o:bd:pyxis_anesthesia_station_es_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_anesthesia_station_es:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_anesthesia_station_4000_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_anesthesia_station_4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_cato_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_cato:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_ciisafe_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_ciisafe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_inventory_connect_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_inventory_connect:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
Show 38 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bd:pyxis_iv_prep_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_iv_prep:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_jitrbud_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_jitrbud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_kanban_rf_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_kanban_rf:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_logistics_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_logistics:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_med_link_family_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_med_link_family:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_medbank_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medbank:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_medstation_4000_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medstation_4000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_medstation_es_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medstation_es:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_medstation_es_server_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medstation_es_server:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_parassist_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_parassist:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_pharmopack_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_pharmopack:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_procedurestation_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_procedurestation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_rapid_rx_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_rapid_rx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_stockstation_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_stockstation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplycenter_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplycenter:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplyroller_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplyroller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplystation_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplystation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_track_and_deliver_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_track_and_deliver:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:rowa_pouch_packaging_systems_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:rowa_pouch_packaging_systems:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
- cpe:2.3:o:bd:pyxis_iv_prep_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_iv_prep:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_jitrbud_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_jitrbud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_kanban_rf_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_kanban_rf:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_logistics_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_logistics:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_med_link_family_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_med_link_family:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_medbank_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medbank:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_medstation_4000_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medstation_4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_medstation_es_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medstation_es:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_medstation_es_server_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medstation_es_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_parassist_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_parassist:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_pharmopack_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_pharmopack:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_procedurestation_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_procedurestation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_rapid_rx_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_rapid_rx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_stockstation_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_stockstation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplycenter_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplycenter:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplyroller_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplyroller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplystation_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplystation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_track_and_deliver_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_track_and_deliver:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:rowa_pouch_packaging_systems_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:rowa_pouch_packaging_systems:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22766
- 2026-10-03 Alias added: GHSA-6j57-8pfh-4g36
References
Sources
- CVE-2022-22766 · CVE Program
- CVE-2022-22766 · NVD
- FIRST EPSS
- GHSA-6j57-8pfh-4g36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences