Lucene search

IcscertCVE-2020-12048

HistoryJun 29, 2020 - 2:15 p.m.

CVE-2020-12048

2020-06-2914:15:11

CWE-319

icscert

web.nvd.nist.gov

cve-2020-12048

phoenix hemodialysis

data-in-transit encryption

network security

medical device security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

42.1%

JSON

Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool.

Affected configurations

Nvd

Node

baxterphoenix_x36Match-

AND

baxterphoenix_x36_firmwareMatch3.36

baxterphoenix_x36_firmwareMatch3.40

VendorProductVersionCPE
baxterphoenix_x36-cpe:2.3:h:baxter:phoenix_x36:-:*:*:*:*:*:*:*
baxterphoenix_x36_firmware3.36cpe:2.3:o:baxter:phoenix_x36_firmware:3.36:*:*:*:*:*:*:*
baxterphoenix_x36_firmware3.40cpe:2.3:o:baxter:phoenix_x36_firmware:3.40:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
baxter	phoenix_x36	-	cpe:2.3:h:baxter:phoenix_x36:-:::::::*
baxter	phoenix_x36_firmware	3.36	cpe:2.3:o:baxter:phoenix_x36_firmware:3.36:::::::*
baxter	phoenix_x36_firmware	3.40	cpe:2.3:o:baxter:phoenix_x36_firmware:3.40:::::::*

CNA Affected

[
  {
    "product": "Baxter Phoenix Hemodialysis Delivery System",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Phoenix Hemodialysis Delivery System SW 3.36 and 3.40"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsma-20-170-03

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

42.1%

JSON

Related for CVE-2020-12048