title: BD Pyxis Products - Hardcoded Credentials
description: Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
product: BD Pyxis Anesthesia Station ES
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis Anesthesia Station 4000
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis CATO
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis CIISafe
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis Inventory Connect
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis IV Prep
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis JITrBUD
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis KanBan RF
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis Logistics
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis Med Link Family
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis MedBank
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis MedStation 4000
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis MedStation ES
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis MedStation ES Server
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis ParAssist
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis PharmoPack
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis ProcedureStation (including EC)
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis Rapid Rx
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis StockStation
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis SupplyCenter
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis SupplyRoller
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis SupplyStation (including RF, EC, CP)
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Pyxis Track and Deliver
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
{
product: BD Rowa Pouch Packaging Systems
vendor: Becton Dickinson (BD)
versions:
status: affected, version: All
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
workarounds: Limit physical access to the device to only authorized personnel. Tightly control management of BD Pyxis system credentials provided to authorized users. Isolate affected products in a secure VLAN or behind firewalls with restricted access that only permits communication with trusted hosts in other networks when needed. Monitor and log all network traffic attempting to reach the affected products for suspicious activity. Work with your local BD support team ensure all patching and virus definitions are up to date. The Pyxis Security Module for automated patching and virus definition management is provided to all accounts.