Vulnerability · Published Sep 9, 2022 · Assigned by Baxter
CVE-2022-26394Unauthenticated network reconfiguration via TCP/UDP
Medium 5.5
In plain English
A medium-severity missing authentication in Baxter Spectrum Wireless Battery Module (WBM) from Baxter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 71.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Baxter | Baxter Spectrum Wireless Battery Module (WBM) | 1616D381717D1920D2920D3020D3120D32 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx x_refsource_MISC