BD Pyxis™ Products – Default Credentials

Description

Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.

Timeline

Scores

EPSS (exploitation in 30 days)

0.43% · top 63% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• CWE-262: Not Using Password Aging (opens in a new tab)All about CWE-262 and its CVEs
• CWE-522 (opens in a new tab)All about CWE-522 and its CVEs

Affected products

• Becton Dickinson (BD) · BD Pyxis™ Anesthesia ES Station

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ CIISafe

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ Logistics

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ MedBank

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ MedStation™ 4000

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ MedStation™ ES

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ MedStation™ ES Server

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ ParAssist

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ Rapid Rx

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ StockStation

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ SupplyCenter

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ SupplyRoller

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ SupplyStation™

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ SupplyStation™ EC

  • affected All versions

• Becton Dickinson (BD) · BD Pyxis™ SupplyStation™ RF auxiliary

  • affected All versions

• Becton Dickinson (BD) · BD Rowa™ Pouch Packaging Systems

  • affected All versions

What to do

Solution: BD is currently strengthening our credential management capabilities in BD Pyxis™ products. Service personnel are proactively working with customers whose domain-joined server(s) credentials require updates. BD is currently piloting a credential management solution that is initially targeted for only specific BD Pyxis™ product versions and will allow for improved authentication management practices with specific local operating system credentials. Changes needed for installation, upgrade or to applications are being evaluated as part of the overall remediation.

Workaround: Limit physical access to only authorized personnel.

Workaround: Tightly control management of system passwords provided to authorized users.

Workaround: Isolate affected products in a secure VLAN or behind firewalls with restricted access that only permits communication with trusted hosts in other networks when needed.

Workaround: Work with your local BD support team to ensure that patching and virus definitions are up to date. The BD Remote Support Services Solution for automated patching and virus definition management is an available solution for customer accounts.

References (1)

• https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products-default-credentials (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-22767](https://trackcve.app/badge/CVE-2022-22767.svg)](https://trackcve.app/cve/CVE-2022-22767)

Record last updated 16 Sept 2024, 16:42 UTC.