CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2022-22766
Medium (5.5) in bd. EPSS 0.2% chance of exploitation in the next 30 days.
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-798
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bd:pyxis_anesthesia_station_4000_firmware
- bd:pyxis_anesthesia_station_es_firmware
- bd:pyxis_cato_firmware
- bd:pyxis_ciisafe_firmware
- bd:pyxis_inventory_connect_firmware
- bd:pyxis_iv_prep_firmware
- bd:pyxis_jitrbud_firmware
- bd:pyxis_kanban_rf_firmware
- bd:pyxis_logistics_firmware
- bd:pyxis_med_link_family_firmware
- bd:pyxis_medbank_firmware
- bd:pyxis_medstation_4000_firmware
- bd:pyxis_medstation_es_firmware
- bd:pyxis_medstation_es_server_firmware
- bd:pyxis_parassist_firmware
- bd:pyxis_pharmopack_firmware
- bd:pyxis_procedurestation_firmware
- bd:pyxis_rapid_rx_firmware
- bd:pyxis_stockstation_firmware
- bd:pyxis_supplycenter_firmware
- bd:pyxis_supplyroller_firmware
- bd:pyxis_supplystation_firmware
- bd:pyxis_track_and_deliver_firmware
- bd:rowa_pouch_packaging_systems_firmware
References
- https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products---hardcoded-credentials
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01
- https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products---hardcoded-credentials
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01