PatchSiren cyber security CVE debrief
CVE-2016-9355 Bd CVE debrief
CVE-2016-9355 describes a physical-access vulnerability in the BD Alaris 8015 Point of Care unit where an unauthorized person who can disassemble the device and access its flash memory may retrieve unencrypted wireless network authentication credentials and other sensitive technical data. The issue is tied to how the device stores secrets on removable flash memory, which can reduce the chance of immediate detection while extraction occurs at the attacker's convenience.
- Vendor
- Bd
- Product
- Alaris 8015 Pc Unit
- CVSS
- MEDIUM 6.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-01-17
- Original CVE updated
- 2021-03-16
- Advisory published
- 2017-01-17
- Advisory updated
- 2021-03-16
Who should care
Healthcare organizations, clinical engineering teams, biomedical device owners, OT/ICS security teams, and IT administrators responsible for BD Alaris 8015 Point of Care units should care, especially where devices are physically accessible or handled outside tightly controlled areas.
Technical summary
NVD lists the weakness as CWE-255 and assigns CVSS v3.0 AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, reflecting a physically local issue with high confidentiality impact. The vulnerable scope in NVD includes BD Alaris 8015 PC unit versions 9.5 and earlier, plus version 9.7. The core problem is storage of wireless authentication credentials and other sensitive technical data on removable flash memory that can be extracted after device disassembly.
Defensive priority
Medium. The vulnerability is serious because it can expose wireless credentials and technical data, but exploitation requires physical access to the device, which limits broad remote risk.
Recommended defensive actions
- Inventory BD Alaris 8015 Point of Care units and confirm affected versions against the NVD-listed scope.
- Restrict physical access to devices and any removable storage components through locked rooms, controlled custody, and tamper-aware checks.
- Coordinate with the vendor and medical device support channels to determine whether a firmware or design update is available for secret storage.
- Rotate or reissue any wireless network credentials that may have been stored on affected devices if exposure is suspected.
- Review whether affected devices are permitted to retain sensitive secrets locally and, if possible, move credential handling to safer storage practices.
- Add device handling and decommissioning procedures that include secure removal and sanitization of flash media where supported by vendor guidance.
Evidence notes
The description and NVD CVSS vector both indicate a physical-access requirement. The published CVE date used here is 2017-02-13 from the supplied timeline. NVD’s modified timestamp is 2026-05-13, but that is not the vulnerability issue date. The supplied corpus also identifies the affected versions as 9.5 and prior versions, and version 9.7.
Sources and references
Verified primary and authoritative sources
-
CVE-2016-9355 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2016-9355
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2016-9355 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9355
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02
[email protected] - Mitigation, Third Party Advisory, US Government Resource
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.