CVE-2022-26392 Format String vulnerability

The Baxter Spectrum WBM v16, v16D38 and Baxter Spectrum WBM v17, v17D19, v20D29 to v20D32 when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information...

CVE-2022-26393

CVE-2022-26393 is a Baxter Sigma Spectrum/WBM format-string vulnerability impacting Wi‑Fi SSID processing (v20D29 in WBM). The flaw allows attackers to trigger format string attacks to read memory and, in some contexts, cause DoS when processing SSID data over the Wi‑Fi interface. Affected produc...

CVE-2022-26393 Format String vulnerability

The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service DoS on the WBM...

CVE-2022-26390

CVE-2022-26390 affects Baxter SIGMA Spectrum/Spectrum/WBM: Wireless Battery Module versions (e.g., v16, v16D38, v17, v17D19, v20D29–v20D32, v22D19–v22D28) where network credentials and PHI stored in unencrypted form on the WBM. Exploitation requires physical access to a device that hasn’t had dat...

CVE-2022-26390 Unencrypted internal storage of security credentials

The Baxter Spectrum Wireless Battery Module WBM stores network credentials and PHI only applicable to Spectrum IQ pumps using auto programming in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive informatio...

CVE-2022-26392

CVE-2022-26392 is a format-string vulnerability in Baxter Spectrum WBM firmware (v16, v16D38, v17, v17D19, v20D29–v20D32) that is exploitable when the device runs in superuser mode and processes application messages. The issue can let an attacker read memory on the WBM via a Telnet/hostmessage co...

CVE-2022-26394 Unauthenticated network reconfiguration via TCP/UDP

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

CVE-2022-26394

CVE-2022-26394: Baxter Spectrum WBM/Sigma Spectrum devices fail mutual authentication with the gateway host, enabling a potential MITM and parameter manipulation that could disrupt network operation. Affected products include Sigma Spectrum v6.x/v8.x, Baxter Spectrum IQ v9.x, and Wireless Battery...

PT-2022-17824 · Baxter · Baxter Spectrum Wbm

Name of the Vulnerable Software and Affected Versions: Baxter Spectrum WBM versions v16 through v17 Baxter Spectrum WBM versions v20D29 through v20D32 Description: The issue allows for format string attacks via application messaging when in superuser mode, potentially enabling an attacker to read...

PT-2022-17825 · Baxter · Baxter Spectrum Wbm

Name of the Vulnerable Software and Affected Versions: Baxter Spectrum WBM affected versions not specified Description: The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information o...

PT-2022-17826 · Baxter · Baxter Spectrum Wbm

Name of the Vulnerable Software and Affected Versions: Baxter Spectrum WBM affected versions not specified Description: The issue concerns a lack of mutual authentication with the gateway server host. This could allow an attacker to perform a man-in-the-middle attack, modifying parameters to caus...

CVE-2022-26392

The Baxter Spectrum WBM v16, v16D38 and Baxter Spectrum WBM v17, v17D19, v20D29 to v20D32 when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information...

CVE-2022-26390

The Baxter Spectrum Wireless Battery Module WBM stores network credentials and PHI only applicable to Spectrum IQ pumps using auto programming in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive informatio...

CVE-2022-26393

The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service DoS on the WBM...

CVE-2022-26394

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

Baxter SIGMA Spectrum Infusion Pumps: Multiple Vulnerabilities (FIXED)

Rapid7, Inc. Rapid7 discovered vulnerabilities in two TCP/IP-enabled medical devices produced by Baxter Healthcare. The affected products are: SIGMA Spectrum Infusion Pump Firmware Version 8.00.01 SIGMA Wi-Fi Battery Firmware Versions 16, 17, 20 D29 Rapid7 initially reported these issues to Baxte...

Baxter Spectrum 格式化字符串错误漏洞

Baxter Spectrum is an infusion pump from Baxter USA. A format string error vulnerability exists in the Baxter Sigma and Baxter Spectrum Infusion Pumps that stems from its susceptibility to a format string attack delivered via an application message resulting in an attacker being able to use it to...

Baxter Spectrum 格式化字符串错误漏洞

Baxter Spectrum is an infusion pump from Baxter, Inc. A format string error vulnerability exists in the Baxter Spectrum WBM v20D29, which stems from vulnerability to a format string attack delivered via an application message, and can be used by an attacker to read memory in the WBM to access...

Baxter Spectrum 安全漏洞

Baxter Spectrum is an infusion pump from Baxter USA. The Baxter Sigma and Baxter Spectrum Infusion Pumps have a security vulnerability that stems from the fact that they store network credentials and patient health information PHI in unencrypted form.PHI is stored using an automated program only ...

Baxter Sigma Spectrum Infusion Pump (Update A)

1. EXECUTIVE SUMMARY --------- Begin Update A part 1 of 3 --------- CVSS v3 7.5 --------- End Update A part 1 of 3 --------- ATTENTION: Exploitable remotely Vendor: Baxter Equipment: Sigma and Baxter Spectrum Infusion Pumps Vulnerabilities: Missing Encryption of Sensitive Data, Use of Externally...