CVE-2020-12039

2020-06-2913:45:48

CWE-259

icscert

www.cve.org

3.8 Low

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.4%

JSON

Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v’s6.x model 35700BAX & Baxter Spectrum Infusion System v’s8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed.

CNA Affected

[
  {
    "product": "Baxter Sigma Spectrum Infusion Pumps",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Sigma Spectrum v6.x model 35700BAX,Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module (WBM) v9,v11,v13,v14,v15,v16,v20D29,v20D30,v20D31,v22D24, Spectrum v8.x w/WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum LVP v8.x with WBM v17, v20D29,v20D30,v20D31,and v22D24"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsma-20-170-04