Vulnerability · Published Jun 29, 2020 · Assigned by icscert
CVE-2020-12047
Critical 9.8
In plain English
A critical-severity security flaw in Baxter Sigma Spectrum Infusion Pumps. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.7%top 23.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless configuration enables an FTP service with hard-coded credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Baxter Sigma Spectrum Infusion Pumps | Sigma Spectrum v6.x model 35700BAX,Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module (WBM) v9,v11,v13,v14,v15,v16,v20D29,v20D30,v20D31,v22D24, Spectrum v8.x w/WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum LVP v8.x with WBM v17, v20D29,v20D30,v20D31,and v22D24 |
Weakness: CWE-259
References
- https://www.us-cert.gov/ics/advisories/icsma-20-170-04 x_refsource_MISC