Is CVE-2016-9355 actively exploited?

No active exploitation of CVE-2016-9355 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2016-9355 be exploited remotely?

No. CVE-2016-9355 requires physical access to exploit.

What is the CVSS score of CVE-2016-9355?

CVE-2016-9355 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2016-9355

MEDIUM

CVE-2016-9355

CWE-255Published: February 13, 2017· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience.

NVD Source

Technical Analysis

CVE-2016-9355 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.3.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.