PatchTheCVE: symbiq infusion system firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2015-3956: Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Shttps://patchthecve.com/cve/CVE-2015-3956.htmlhttps://patchthecve.com/cve/CVE-2015-3956.htmlWed, 17 Jun 2026 00:26:32 +0000CRITICAL 9.8: Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network.CVE-2015-3954: Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Shttps://patchthecve.com/cve/CVE-2015-3954.htmlhttps://patchthecve.com/cve/CVE-2015-3954.htmlWed, 17 Jun 2026 00:26:32 +0000CRITICAL 9.8: Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the pump. Hospira recommenCVE-2015-3953: Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infhttps://patchthecve.com/cve/CVE-2015-3953.htmlhttps://patchthecve.com/cve/CVE-2015-3953.htmlWed, 17 Jun 2026 00:26:32 +0000CRITICAL 9.8: Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. HospiCVE-2015-3952: Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infhttps://patchthecve.com/cve/CVE-2015-3952.htmlhttps://patchthecve.com/cve/CVE-2015-3952.htmlWed, 17 Jun 2026 00:26:31 +0000HIGH 7.5: Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. HospiCVE-2015-3965: Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated ophttps://patchthecve.com/cve/CVE-2015-3965.htmlhttps://patchthecve.com/cve/CVE-2015-3965.htmlWed, 17 Jun 2026 00:26:33 +0000HIGH 8.8: Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.