PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9355 Bd CVE debrief

CVE-2016-9355 describes a physical-access vulnerability in the BD Alaris 8015 Point of Care unit where an unauthorized person who can disassemble the device and access its flash memory may retrieve unencrypted wireless network authentication credentials and other sensitive technical data. The issue is tied to how the device stores secrets on removable flash memory, which can reduce the chance of immediate detection while extraction occurs at the attacker's convenience.

Vendor
Bd
Product
Alaris 8015 Pc Unit
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-17
Original CVE updated
2021-03-16
Advisory published
2017-01-17
Advisory updated
2021-03-16

Who should care

Healthcare organizations, clinical engineering teams, biomedical device owners, OT/ICS security teams, and IT administrators responsible for BD Alaris 8015 Point of Care units should care, especially where devices are physically accessible or handled outside tightly controlled areas.

Technical summary

NVD lists the weakness as CWE-255 and assigns CVSS v3.0 AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, reflecting a physically local issue with high confidentiality impact. The vulnerable scope in NVD includes BD Alaris 8015 PC unit versions 9.5 and earlier, plus version 9.7. The core problem is storage of wireless authentication credentials and other sensitive technical data on removable flash memory that can be extracted after device disassembly.

Defensive priority

Medium. The vulnerability is serious because it can expose wireless credentials and technical data, but exploitation requires physical access to the device, which limits broad remote risk.

Recommended defensive actions

  • Inventory BD Alaris 8015 Point of Care units and confirm affected versions against the NVD-listed scope.
  • Restrict physical access to devices and any removable storage components through locked rooms, controlled custody, and tamper-aware checks.
  • Coordinate with the vendor and medical device support channels to determine whether a firmware or design update is available for secret storage.
  • Rotate or reissue any wireless network credentials that may have been stored on affected devices if exposure is suspected.
  • Review whether affected devices are permitted to retain sensitive secrets locally and, if possible, move credential handling to safer storage practices.
  • Add device handling and decommissioning procedures that include secure removal and sanitization of flash media where supported by vendor guidance.

Evidence notes

The description and NVD CVSS vector both indicate a physical-access requirement. The published CVE date used here is 2017-02-13 from the supplied timeline. NVD’s modified timestamp is 2026-05-13, but that is not the vulnerability issue date. The supplied corpus also identifies the affected versions as 9.5 and prior versions, and version 9.7.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9355 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9355

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9355 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9355

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.