CVE-2014-5406

CVE-2014-5406 describes a critical vulnerability in Hospira LifeCare PCA Infusion Systems prior to version 7.0, specifically affecting the PCA3, PCA5, and PCA Infusion firmware. The flaw stems from a lack of network traffic validation when sending drug library, software update, or configuration changes, allowing remote attackers to alter device settings or medication data. With a CVSS score of 9.3, this vulnerability is highly severe due to its network-based attack vector, medium complexity, and complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness of its potential impact.