Lucene search

[email protected]CVE-2022-26390

HistorySep 09, 2022 - 3:15 p.m.

CVE-2022-26390

2022-09-0915:15:00

CWE-312

[email protected]

web.nvd.nist.gov

baxter spectrum

wireless battery module

wbm

network credentials

phi

unencrypted

sensitive information

nvd

cve-2022-26390

4.2 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.6 Medium

AI Score

Confidence

High

1.2 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

21.5%

JSON

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn’t had all data and settings erased may be able to extract sensitive information.

CPENameOperatorVersion
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwarele20d32
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwarele22d28
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq16
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq16d38
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq17
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq17d19
baxter:sigma_spectrum_35700bax_firmwarebaxter sigma spectrum 35700bax firmwareeq-
baxter:sigma_spectrum_35700bax2_firmwarebaxter sigma spectrum 35700bax2 firmwareeq-
baxter:baxter_spectrum_iq_35700bax3_firmwarebaxter baxter spectrum iq 35700bax3 firmwareeq-

CPE	Name	Operator	Version
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	le	20d32
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	le	22d28
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	16
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	16d38
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	17
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	17d19
baxter:sigma_spectrum_35700bax_firmware	baxter sigma spectrum 35700bax firmware	eq	-
baxter:sigma_spectrum_35700bax2_firmware	baxter sigma spectrum 35700bax2 firmware	eq	-
baxter:baxter_spectrum_iq_35700bax3_firmware	baxter baxter spectrum iq 35700bax3 firmware	eq	-

References

www.cisa.gov/uscert/ics/advisories/icsma-22-251-01

www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

Social References

4.2 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.6 Medium

AI Score

Confidence

High

1.2 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

21.5%

JSON

Related for CVE-2022-26390

prion1 thn1 ics1 rapid7blog1