PT-2020-13006

Name of the Vulnerable Software and Affected Versions Baxter Sigma Spectrum Infusion System versions 6.x through 8.x Description The issue concerns hardcoded passwords in the Baxter Sigma Spectrum Infusion System. When these passwords are physically entered on the keypad, they provide access to...

CVE-2020-12039: Use of Hard-coded Password

Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration value...

Command injection

Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16 is remotely accessible via Port 22/SSH without authentication. A remote attacker may be able to make unauthorized configuration changes to the WBM, as well as issue commands to access...

Design/Logic Flaw

An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16, which may allow an attacker to gain access the hos...

CVE-2014-5433

An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16, which may allow an attacker to gain access the hos...

CVE-2014-5431: Use of Hard-coded Password

Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16 contains a hard-coded password, which provides access to basic biomedical information, limited device settings, and network configuration of the WBM, if connected. The hard-coded password...

CVE-2014-5433: Cleartext Storage of Sensitive Information

An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16, which may allow an attacker to gain access the hos...

PT-2019-7130

Name of the Vulnerable Software and Affected Versions Baxter SIGMA Spectrum Infusion System version 6.05 Description The issue concerns a default account with hard-coded credentials used in conjunction with the FTP protocol. It is specified that no files can be transferred to or from the wireless...

PT-2019-7128

Name of the Vulnerable Software and Affected Versions Baxter SIGMA Spectrum Infusion System version 6.05 Description The issue allows remote access via Port 22/SSH without authentication, enabling a remote attacker to make unauthorized configuration changes to the wireless battery module WBM and...

PT-2019-7127

Name of the Vulnerable Software and Affected Versions Baxter SIGMA Spectrum Infusion System version 6.05 Description The issue concerns a hard-coded password in the wireless battery module of the Baxter SIGMA Spectrum Infusion System. This password provides access to basic biomedical information,...

PT-2019-7129

Name of the Vulnerable Software and Affected Versions Baxter SIGMA Spectrum Infusion System version 6.05 Description An unauthenticated remote attacker may be able to execute commands to view wireless account credentials stored in cleartext, potentially allowing access to the host network...

CVE-2014-5434: Use of Hard-coded Password

Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16 has a default account with hard-coded credentials used with the FTP protocol. Baxter asserts no files can be transferred to or from the WBM using this account. Baxter has released a new...

CVE-2014-5432: DEPRECATED: Authentication Bypass Issues

Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16 is remotely accessible via Port 22/SSH without authentication. A remote attacker may be able to make unauthorized configuration changes to the WBM, as well as issue commands to access...