What’s Vulnerable › Vulnerabilities
CVE-2022-22767: BD Pyxis™ Products – Default Credentials
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-06-02 · updated 2026-06-17
- Weakness: CWE-262
Description
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.
Affected products
- Bd Pyxis Anesthesia Station Es Firmware: all versions
- Bd Pyxis Ciisafe Firmware: all versions
- Bd Pyxis Logistics Firmware: all versions
- Bd Pyxis Medbank Firmware: all versions
- Bd Pyxis Medstation 4000 Firmware: all versions
- Bd Pyxis Medstation Es Firmware: all versions
- Bd Pyxis Medstation Es Server Firmware: all versions
- Bd Pyxis Parassist Firmware: all versions
- Bd Pyxis Rapid Rx Firmware: all versions
- Bd Pyxis Stockstation Firmware: all versions
- Bd Pyxis Supplycenter Firmware: all versions
- Bd Pyxis Supplyroller Firmware: all versions
- Bd Pyxis Supplystation Ec Firmware: all versions
- Bd Pyxis Supplystation Firmware: all versions
- Bd Pyxis Supplystation Rf Auxiliary Firmware: all versions
- Bd Rowa Pouch Packaging Systems Firmware: all versions
References
- https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products-default-credentials
- https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products-default-credentials
Get alerted when CVE-2022-22767 or the next vulnerability affects your stack