Medium severity · published Apr 1, 2020
CVE-2020-10598
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality…
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices. Specially crafted inputs could allow the user to escape the restricted environment, resulting in access to sensitive data.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pyxis Anesthesia Station ES Firmware · BD
1.6.1 · source: NVD
PM
Pyxis Medstation ES Firmware · BD
1.6.1 · source: NVD
Affected product
PA
Pyxis Anesthesia Station ES Firmware
BD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10598
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsma-20-091-01
More from Pyxis Anesthesia Station ES Firmware
8.8
CVE-2022-22767
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials
5.5
CVE-2022-22766
Hardcoded credentials are used in specific BD Pyxis products