High severity · published Jun 2, 2022
CVE-2022-22767
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pyxis Anesthesia Station ES Firmware · BD
All versions, or not specified · source: NVD
PC
Pyxis Ciisafe Firmware · BD
All versions, or not specified · source: NVD
PL
Pyxis Logistics Firmware · BD
All versions, or not specified · source: NVD
PM
Pyxis Medbank Firmware · BD
All versions, or not specified · source: NVD
PM
Pyxis Medstation 4000 Firmware · BD
All versions, or not specified · source: NVD
PM
Pyxis Medstation ES Firmware · BD
All versions, or not specified · source: NVD
PM
Pyxis Medstation ES Server Firmware · BD
All versions, or not specified · source: NVD
PP
Pyxis Parassist Firmware · BD
All versions, or not specified · source: NVD
PR
Pyxis Rapid RX Firmware · BD
All versions, or not specified · source: NVD
PS
Pyxis Stockstation Firmware · BD
All versions, or not specified · source: NVD
PS
Pyxis Supplycenter Firmware · BD
All versions, or not specified · source: NVD
PS
Pyxis Supplyroller Firmware · BD
All versions, or not specified · source: NVD
Affected product
PA
Pyxis Anesthesia Station ES Firmware
BD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22767
Vendor Advisory
https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products-default-credentials
More from Pyxis Anesthesia Station ES Firmware
6.1
CVE-2020-10598
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality…
5.5
CVE-2022-22766
Hardcoded credentials are used in specific BD Pyxis products
