Vulnerability · Published Jun 29, 2020 · Assigned by icscert

CVE-2020-12048

High 7.5

In plain English

A high-severity security flaw in Baxter Phoenix Hemodialysis Delivery System. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool.

Affected products (as reported)

Vendor	Product	Versions
n/a	Baxter Phoenix Hemodialysis Delivery System	Phoenix Hemodialysis Delivery System SW 3.36 and 3.40

Weakness: CWE-319

References

https://www.us-cert.gov/ics/advisories/icsma-20-170-03 x_refsource_MISC