Hospira LifeCare PCA Infusion System Vulnerabilities

An attacker with network access could modify drug dosage setpoints, stop infusions, or alter medication delivery parameters, directly threatening patient safety. These systems are life-critical and any unauthorized command could cause patient harm.

Hospital pharmacy and nursing staff who administer medication via Hospira LifeCare PCA infusion pumps. This affects critical medication delivery in acute care, post-operative pain management, and cancer treatment settings. Any hospital relying on LifeCare PCA systems for patient care is at risk.

An attacker on the hospital network could connect to the LifeCare PCA system using weak or default credentials, then exploit authentication or encryption weaknesses to send unauthorized commands that alter infusion parameters or interrupt drug delivery. The vulnerabilities span weak credential handling (hardcoded passwords), lack of encryption for data in transit, and memory issues that could allow code execution.