PT-2018-5449 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Publicado 2018-02-15 · Atualizado 2018-03-02 · CVE-2017-12721

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6

Description: An issue with improper certificate validation was found, which could allow a man-in-the-middle (MITM) attack. The pump fails to validate host certificates.

Recommendations: For version 1.1, update the certificate validation mechanism to prevent MITM attacks. For version 1.5, ensure proper host certificate validation is implemented to secure the connection. For version 1.6, modify the certificate validation process to verify the authenticity of host certificates and prevent unauthorized access.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-12721

Produtos afetados

Medfusion 4000 Wireless Syringe Infusion Pump

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Nota
• https://osv.dev/vulnerability/CVE-2017-12721 · Aviso do Fabricante
• http://securityfocus.com/bid/100665 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12721 · Nota de Segurança