BD Pyxis™ Products – Default Credentials
Priority LOW 38CWE-262Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.
Why it matters now
EPSS 0.00425 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Becton, Dickinson and Company (BD) | BD Pyxis™ Anesthesia ES Station | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ CIISafe | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ Logistics | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ MedBank | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ MedStation™ 4000 | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ MedStation™ ES | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ MedStation™ ES Server | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ ParAssist | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ Rapid Rx | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ StockStation | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ SupplyCenter | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ SupplyRoller | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ SupplyStation™ | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ SupplyStation™ EC | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Pyxis™ SupplyStation™ RF auxiliary | All versions | — | No fix listed | CNA |
| Becton, Dickinson and Company (BD) | BD Rowa™ Pouch Packaging Systems | All versions | — | No fix listed | CNA |
- BD Pyxis™ Anesthesia ES Station VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ CIISafe VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ Logistics VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ MedBank VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ MedStation™ 4000 VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ MedStation™ ES VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ MedStation™ ES Server VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ ParAssist VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ Rapid Rx VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ StockStation VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ SupplyCenter VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ SupplyRoller VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ SupplyStation™ VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ SupplyStation™ EC VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Pyxis™ SupplyStation™ RF auxiliary VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
- BD Rowa™ Pouch Packaging Systems VendorBecton, Dickinson and Company (BD) Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bd:pyxis_anesthesia_station_es_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_anesthesia_station_es:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_ciisafe_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_ciisafe:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_logistics_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_logistics:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_medbank_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medbank:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_medstation_4000_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medstation_4000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
- cpe:2.3:o:bd:pyxis_anesthesia_station_es_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_anesthesia_station_es:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_ciisafe_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_ciisafe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_logistics_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_logistics:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_medbank_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medbank:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_medstation_4000_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medstation_4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bd:pyxis_medstation_es_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medstation_es:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_medstation_es_server_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_medstation_es_server:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_parassist_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_parassist:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_rapid_rx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_rapid_rx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_stockstation_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_stockstation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplycenter_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplycenter:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplyroller_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplyroller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplystation_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplystation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplystation_ec_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplystation_ec:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:pyxis_supplystation_rf_auxiliary_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:pyxis_supplystation_rf_auxiliary:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
| cpe:2.3:o:bd:rowa_pouch_packaging_systems_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Becton, Dickinson and Company (BD) |
| cpe:2.3:h:bd:rowa_pouch_packaging_systems:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Becton, Dickinson and Company (BD) |
- cpe:2.3:o:bd:pyxis_medstation_es_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medstation_es:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_medstation_es_server_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_medstation_es_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_parassist_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_parassist:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_rapid_rx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_rapid_rx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_stockstation_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_stockstation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplycenter_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplycenter:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplyroller_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplyroller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplystation_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplystation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplystation_ec_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplystation_ec:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:pyxis_supplystation_rf_auxiliary_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:pyxis_supplystation_rf_auxiliary:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
- cpe:2.3:o:bd:rowa_pouch_packaging_systems_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Becton, Dickinson and Company (BD)
- cpe:2.3:h:bd:rowa_pouch_packaging_systems:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Becton, Dickinson and Company (BD)
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22767
- 2026-10-03 Alias added: GHSA-6qrf-f2g2-q6w9
References
More Becton, Dickinson and Company (BD) Pyxis Anesthesia Station Es Firmware vulnerabilities
- TI-2022-07016 BD Pyxis Products - Hardcoded Credentials CVSS 3.1HIGH 7.0
- TI-2020-08510 Protection mechanism failure in Becton, Dickinson and Company (BD) Pyxis MedStation ES… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-22767 · CVE Program
- CVE-2022-22767 · NVD
- FIRST EPSS
- GHSA-6qrf-f2g2-q6w9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences