Security readout for executives and security teams
Plain-English summary
Affected Hospira infusion pumps may accept critical instructions from unauthenticated devices on the same host network. That could allow unauthorized changes to drug libraries, firmware, pump commands, or configuration. The sources do not provide CVSS scoring or confirmed exploitation, but the clinical environment makes exposure important to address quickly.
Executive priority
Treat this as a high-priority medical device network exposure if affected pumps remain deployed. Prioritize inventory and port closure verification before broader remediation planning.
Technical view
CVE-2015-3956 is a CWE-345 authenticity verification issue affecting Hospira Plum A+ <=13.4, Plum A+3 <=13.6, and Symbiq <=3.13. The devices accept sensitive updates and commands from unauthenticated network peers. Hospira recommended closing FTP port 20 and Telnet port 23; Plum 360 is stated as not vulnerable.
Likely exposure
Exposure is most likely in healthcare environments still operating the listed Hospira infusion systems on connected host networks, especially where FTP or Telnet access remains open to broad internal network segments.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. The described attack surface is network-local: an unauthenticated device on the host network could influence pump behavior or configuration if controls are absent.
Researcher notes
Evidence is limited to the CVE bundle and the referenced ICS-CERT advisory. No CVSS, patch details, or exploitation evidence are provided. Avoid assuming internet exposure; focus validation on host-network reachability and affected firmware versions.
Mitigation direction
- Inventory Hospira Plum A+, Plum A+3, and Symbiq devices and firmware versions.
- Close Port 20/FTP on affected devices as Hospira recommended.
- Close Port 23/TELNET on affected devices as Hospira recommended.
- Check current Hospira and CISA/ICS guidance before making clinical workflow changes.
- Evaluate vendor-supported replacement with Plum 360 where operationally appropriate.
Validation and detection
- Confirm whether deployed devices match the affected products and version thresholds.
- Verify FTP port 20 is blocked or closed for affected pumps.
- Verify Telnet port 23 is blocked or closed for affected pumps.
- Review network access paths to ensure only authorized systems can reach pump host networks.
- Document compensating controls and clinical approval for any changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2015-3956 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.