Medium 6.9HealthcarePublished Jul 13, 2023

CVE-2023-30564Stored Cross-Site Scripting on Device Import Functionality

Updated under an hour ago (Oct 26, 2026, 4:30 PM ET)

Does this affect you?

It affects Becton Dickinson & Co BD Alarisâ„¢ Systems Manager and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.29%, higher than 20% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Becton Dickinson & Co BD Alarisâ„¢ Systems Manager

Exploited in the last 30 days

Alaris Systems Manager does not perform input validation during the Device Import Function.

CVSS: 6.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.29% (percentile 20)
Assigned by: BD
NVD analysis: Modified
Record last updated: Oct 22, 2024
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Becton Dickinson & Co BD Alarisâ„¢ Systems Manager becton_dickinson_and:bd_alarisa_systems_manager (from the name)	through 12.3	CNA record
bd alaris_systems_manager bd:alaris_systems_manager	through 12.3	NVD

References

References

https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx	mitigation, vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.