CVE-2020-12012

Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13, and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 have hard-coded administrative account credentials f...

CVE-2020-12024

Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to th...

CVE-2020-12016

Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 have hard-coded administrative account...

Hardcoded credentials

Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to th...

CVE-2020-12032

CVE-2020-12032 concerns Baxter ExactaMix EM 2400 (versions 1.10–1.11 and 1.13–1.14 per ICS update) and ExactaMix EM1200 (versions 1.1–1.2, 1.4–1.5 per ICS advisory) where device data is stored in an unencrypted database, enabling a network-attacker to view or modify sensitive data including PHI. ...

CVE-2020-12020

CVE-2020-12020 affects Baxter ExactaMix EM 2400 (versions 1.10, 1.11, 1.13) and ExactaMix EM1200 (versions 1.1, 1.2, 1.4). The Red Hat and ICS advisories describe an improper access control flaw that allows non-administrative users to access the operating system and edit the application startup s...

CVE-2020-12024

Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to th...

CVE-2020-12024

CVE-2020-12024 affects Baxter ExactaMix EM2400 (versions 1.10, 1.11, 1.13, 1.14) and ExactaMix EM1200 (versions 1.1, 1.2, 1.4, 1.5). Root cause: inadequate restriction of USB interface access by unauthorized users with physical access, enabling loading of unauthorized payloads or direct hard driv...

CVE-2020-12024: Improper Access Control

Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to th...

PT-2020-12988

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10 through 1.13 Baxter ExactaMix EM1200 versions 1.1 through 1.4 Description The issue allows non-administrative users to gain access to the operating system and edit the application startup script. Successf...

PT-2020-12984

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10 through 1.14 Baxter ExactaMix EM 1200 versions 1.1 through 1.5 Description The issue concerns hard-coded administrative account credentials for the ExactaMix operating system. This could allow an attacker...

PT-2020-12992

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 Baxter ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5 Description The vulnerability allows an attacker with physical access to the system to load an unauthorized payload or gain unauthoriz...

PT-2020-12999

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10 through 1.11 Baxter ExactaMix EM1200 versions 1.1 through 1.2 Description The systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network...

PT-2020-12980

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10 through 1.11 Baxter ExactaMix EM1200 versions 1.1 through 1.2 Description The systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with...

PT-2020-12982

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10 through 1.14 Baxter ExactaMix EM 1200 versions 1.1 through 1.5 Description The ExactaMix application has hard-coded administrative account credentials. Successful exploitation of this issue may allow an...

CVE-2020-12016: Use of Hard-coded Password

Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 have hard-coded administrative account...

CVE-2020-12008: Cleartext Transmission of Sensitive Information

Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with network access to view sensitive data including PHI...

CVE-2020-12020: Exposure of Resource to Wrong Sphere

Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an...

CVE-2020-12032: Missing Encryption of Sensitive Data

Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI...

CVE-2020-12012: Use of Hard-coded Password

Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13, and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 have hard-coded administrative account credentials f...