CVE-2014-5403
Hospira MedNet Use of Hard-coded Cryptographic Key
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | Medium6.8 | AV:N/AC:L/Au:S/C:C/I:N/A:N |
| NVDNVD · Modified | 2.0 | Medium5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.7% · top 22% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Weakness
Affected products
Hospira · MedNet
- affected ≤ 5.8
- unaffected 6.1
What to do
Solution: Hospira has developed a new version of the MedNet software, MedNet 6.1. Hospira reports that MedNet 6.1 no longer uses hard-coded passwords, hard-coded cryptographic keys, and no longer stores passwords in clear text. Existing versions of MedNet can be upgraded to MedNet 6.1. Hospira has produced mitigation recommendations that help mitigate the vulnerability in the vulnerable version of JBoss Enterprise Application Platform software, used in the MedNet software. This has been addressed by Hospira through issuance of the following knowledge based articles: Improving Security in Hospira MedNet 5.5 (August 2014) and Improving Security in Hospira MedNet 5.8 (August 2014). For additional information about Hospira’s new releases and mitigation recommendations, contact Hospira’s technical support at 1-800-241-4002.
References (3)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .