title: BD Pyxis™ Products – Default Credentials
description: Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.
problem types: CWE-262: Not Using Password Aging
affected:
{
product: BD Pyxis™ Anesthesia ES Station
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ CIISafe
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ Logistics
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ MedBank
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ MedStation™ 4000
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ MedStation™ ES
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ MedStation™ ES Server
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ ParAssist
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ Rapid Rx
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ StockStation
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ SupplyCenter
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ SupplyRoller
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ SupplyStation™
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ SupplyStation™ EC
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Pyxis™ SupplyStation™ RF auxiliary
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
{
product: BD Rowa™ Pouch Packaging Systems
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All versions
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: BD is currently strengthening our credential management capabilities in BD Pyxis™ products. Service personnel are proactively working with customers whose domain-joined server(s) credentials require updates. BD is currently piloting a credential management solution that is initially targeted for only specific BD Pyxis™ product versions and will allow for improved authentication management practices with specific local operating system credentials. Changes needed for installation, upgrade or to applications are being evaluated as part of the overall remediation.
workarounds: Limit physical access to only authorized personnel.