CVE-2014-5401CWE-94

CVE-2014-5401: vulnerability in Hospira MedNet

Hospira MedNet Code Injection

Published 26 Mar 2019 · Updated 03 Nov 2025

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 5.0%

Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versions of MedNet can be upgraded to MedNet 6.1.

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

Hospira · MedNet

Related CVEs — Hospira MedNet

In the same product, most dangerous first.

CVE-2014-5405—Hospira MedNet Use of Hard-coded PasswordEPSS 2.3%CVE-2014-5403—Hospira MedNet Use of Hard-coded Cryptographic KeyEPSS 1.7%CVE-2014-5400—Hospira MedNet Password in Configuration FileEPSS 0.3%

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-090-03.json https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03 https://www.cisa.gov/news-events/ics-advisories/icsa-15-090-03