CVE-2022-22766: BD Pyxis Products - Hardcoded Credentials

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-11 · updated 2026-06-17
Weakness: CWE-798

Description

Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.

Affected products

Bd Pyxis Anesthesia Station 4000 Firmware: all versions
Bd Pyxis Anesthesia Station Es Firmware: all versions
Bd Pyxis Cato Firmware: all versions
Bd Pyxis Ciisafe Firmware: all versions
Bd Pyxis Inventory Connect Firmware: all versions
Bd Pyxis Iv Prep Firmware: all versions
Bd Pyxis Jitrbud Firmware: all versions
Bd Pyxis Kanban Rf Firmware: all versions
Bd Pyxis Logistics Firmware: all versions
Bd Pyxis Med Link Family Firmware: all versions
Bd Pyxis Medbank Firmware: all versions
Bd Pyxis Medstation 4000 Firmware: all versions
Bd Pyxis Medstation Es Firmware: all versions
Bd Pyxis Medstation Es Server Firmware: all versions
Bd Pyxis Parassist Firmware: all versions
Bd Pyxis Pharmopack Firmware: all versions
Bd Pyxis Procedurestation Firmware: all versions
Bd Pyxis Rapid Rx Firmware: all versions
Bd Pyxis Stockstation Firmware: all versions
Bd Pyxis Supplycenter Firmware: all versions
Bd Pyxis Supplyroller Firmware: all versions
Bd Pyxis Supplystation Firmware: all versions
Bd Pyxis Track And Deliver Firmware: all versions
Bd Rowa Pouch Packaging Systems Firmware: all versions

References

Get alerted when CVE-2022-22766 or the next vulnerability affects your stack