PT-2020-13011

Name of the Vulnerable Software and Affected Versions Baxter Spectrum WBM versions v17, v20D29, v20D30, v20D31, and v22D24 Baxter Spectrum v8.x model 35700BAX2 Description The Baxter Spectrum WBM, when used with a Baxter Spectrum v8.x, operates a Telnet service on Port 1023 with hard-coded...

CVE-2020-8573: Use of Hard-coded Credentials

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers BMC are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on t...

CVE-2020-15317: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15327: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication...

CVE-2020-15326: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem...

CVE-2020-10269: Use of Hard-coded Credentials

One of the wireless interfaces within MiR100, MiR200 and possibly according to the vendor other MiR fleet vehicles comes pre-configured in WiFi Master Access Point mode. Credentials to such wireless Access Point default to well known and widely spread SSID MiRRXXXX and passwords omitted. This...

CVE-2020-10276: Use of Hard-coded Credentials

The password for the safety PLC is the default and thus easy to find in manuals, etc.. This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the las...

CVE-2020-10270: Use of Hard-coded Credentials

Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users omitted and passwords omitted. This...

Baxter ExactaMix EM2400 and ExactaMix EM1200 Trust Management Issues Vulnerability (CNVD-2021-21074)

The Baxter ExactaMix EM2400 and ExactaMix EM1200 are both automated drug mixing systems from Baxter. A trust management issue vulnerability exists in the Baxter ExactaMix EM2400 and ExactaMix EM1200, which stems from the ExactaMix application's use of hard-coded administrative account credentials...

Baxter PrismaFlex Hardcoding Vulnerability

The Baxter PrismaFlex is a critical care device from Baxter. A hard-coded vulnerability exists in Baxter PrismaFlex all versions that stems from the fact that PrismaFlex contains a hard-coded service password that can be exploited by an attacker to modify device settings and calibration values...

Baxter Sigma Spectrum Infusion System and Spectrum Infusion System Trust Management Issues Vulnerabilities

The Baxter Sigma Spectrum Infusion System and the Baxter Spectrum Infusion System are both infusion pumps from Baxter, Inc. A trust management issue vulnerability exists in the Baxter Sigma Spectrum Infusion System version 6.x model 35700BAX and the Baxter Spectrum Infusion System version 8.x mod...

Baxter Spectrum WBM Trust Management Issues Vulnerability

The Baxter WBM and Baxter Spectrum are both products of Baxter, Inc.The Baxter WBM is a wireless battery module for use with Baxter products.The Baxter Spectrum is an infusion pump. The WBM used in the Baxter Spectrum has a security vulnerability that can be exploited by an attacker to run Telnet...

Baxter ExactaMix EM2400 and ExactaMix EM1200 Trust Management Issues Vulnerability

The Baxter ExactaMix EM2400 and ExactaMix EM1200 are both automated drug mixing systems from Baxter. A trust management issue vulnerability exists in the Baxter ExactaMix EM2400 and ExactaMix EM1200, which stems from hard-coded credentials used in the admin account of the ExactaMix operating...

Baxter ExactaMix (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Baxter Equipment: Baxter ExactaMix EM 2400 & EM 1200 Vulnerabilities: Use of Hard-coded Password, Cleartext Transmission of Sensitive Data, Missing Encryption of Sensitive Data, Improper Access...

Baxter PrismaFlex and PrisMax (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Baxter Equipment: PrismaFlex and PrisMax Vulnerabilities: Cleartext Transmission of Sensitive Information, Improper Authentication, Use of Hard-Coded Password 2. UPDATE INFORMATION This updated...

Baxter Sigma Spectrum Infusion Pumps (Update B)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Baxter Equipment: Sigma Spectrum Infusion Pumps Vulnerabilities: Use of Hard-coded Password, Cleartext Transmission of Sensitive Data, Incorrect Permission Assignment for Critical Resource, Operation on...

Schneider Electric Unity Loader and OS Loader Software Trust Management Issues Vulnerability

Schneider Electric Unity Loader and OS Loader Software are both products of Schneider Electric, France.Unity Loader is a data exchange utility program.OS Loader Software is a system loading utility program. A trust management issue vulnerability exists in Schneider Electric Unity Loader and OS...

Kiali Service Mesh Privilege Escalation

The vulnerability of the management console for the Istio Kiali service mesh is related to the use of a strictly encrypted encryption key. Exploiting this vulnerability allows an attacker to enhance their privileges by creating self-signed access tokens...

CVE-2020-9289

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...

CVE-2020-9289

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...