CVE-2020-12036

Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption e.g., TLS/SSL when configured to send treatment data to a PDMS Patient Data Management System or an EMR Electronic Medical Record system. An attacker could observe...

CVE-2020-12036

CVE-2020-12036 affects Baxter PrismaFlex (all versions) and PrisMax (all versions prior to 3.x). The root cause is lack of data-in-transit encryption (no TLS/SSL) when these devices send treatment data to a PDMS or EMR, enabling an attacker with network access to observe sensitive data. The ICS a...

CVE-2020-12035

Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provides access to biomedical information, device settings, calibration settings, and network configuration. This could allow an attacker to modify device settings...

CVE-2020-12035

CVE-2020-12035 affects Baxter PrismaFlex (all versions) and PrisMax (all versions prior to 3.x). Root cause is a hard-coded service password that grants access to biomedical information, device settings, calibration settings, and network configuration, enabling an attacker to modify device settin...

CVE-2020-12037

Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption e.g., TLS/SSL when configured to send treatment data to a PDMS Patient Data Management System or an EMR Electronic Medical Record system. An attacker could observe...

CVE-2020-12037

CVE-2020-12037 affects Baxter PrismaFlex (all versions) and PrisMax (all versions before 3.x). The root cause is a hard-coded service password (CWE-259), enabling an attacker to access device settings, calibration data, and network configuration. The ICS update also notes lack of data-in-transit ...

CVE-2020-12039

CVE-2020-12039 affects Baxter Sigma Spectrum Infusion System v6.x (35700BAX) and v8.x (35700BAX2); hard-coded passwords entered via keypad grant access to biomedical menus, including device settings, calibration values, and WBM network configuration. This is a local/physical-access issue with pub...

CVE-2020-12039

Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration value...

CVE-2020-12041

The Baxter Spectrum WBM v17, v20D29, v20D30, v20D31, and v22D24 telnet Command-Line Interface, grants access to sensitive data stored on the WBM that permits temporary configuration changes to network settings of the WBM, and allows the WBM to be rebooted. Temporary configuration changes to netwo...

CVE-2020-12041

The Baxter Spectrum Wireless Battery Module (WBM) telnet CLI vulnerability CVE-2020-12041 affects Baxter Spectrum WBM components (v17, v20D29–D32, v22D24). The Telnet interface grants access to sensitive data and permits temporary changes to network settings, including rebooting the WBM, with cha...

CVE-2020-12045

CVE-2020-12045 affects Baxter Spectrum WBM when used with Baxter Spectrum v8.x; the WBM runs a Telnet service on port 1023 with hard-coded credentials. Connected sources document a Telnet exposure tied to WBM/Spectrum configurations and assign high/severe CVSS values (up to 9.8) for this vulnerab...

CVE-2020-12045

The Baxter Spectrum WBM v17, v20D29, v20D30, v20D31, and v22D24 when used in conjunction with a Baxter Spectrum v8.x model 35700BAX2, operates a Telnet service on Port 1023 with hard-coded credentials...

CVE-2020-12043

The Baxter Spectrum WBM v17, v20D29, v20D30, v20D31, and v22D24 when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted...

CVE-2020-12043

CVE-2020-12043 affects Baxter Spectrum WBM wireless configurations (versions v17, v20D29–D32, v22D24). The FTP service on the WBM remains accessible until the unit is rebooted, due to an operation on a resource after expiration/release. NVD lists CVSSv3.1 base score 9.8; ICS advisory notes CVSSv3...

CVE-2020-12047

CVE-2020-12047 affects Baxter Spectrum WBM when used with Spectrum v8.x (model 35700BAX2) in factory-default wireless config; the WBM enables an FTP service with hard-coded credentials (versions v17, v20D29–v20D32, v22D24). Root cause: hard-coded credentials enabling FTP access. Impact per source...

CVE-2020-12047

The Baxter Spectrum WBM v17, v20D29, v20D30, v20D31, and v22D24, when used with a Baxter Spectrum v8.x model 35700BAX2 in a factory-default wireless configuration enables an FTP service with hard-coded credentials...

CVE-2020-12039: Use of Hard-coded Password

Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration value...

CVE-2020-12032: Missing Encryption of Sensitive Data

Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI...

CVE-2020-12041: Incorrect Permission Assignment for Critical Resource

The Baxter Spectrum WBM v17, v20D29, v20D30, v20D31, and v22D24 telnet Command-Line Interface, grants access to sensitive data stored on the WBM that permits temporary configuration changes to network settings of the WBM, and allows the WBM to be rebooted. Temporary configuration changes to netwo...

CVE-2020-12012: Use of Hard-coded Password

Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13, and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 have hard-coded administrative account credentials f...