PT-2018-5452 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Publicado 2018-02-15 · Atualizado 2018-03-02 · CVE-2017-12724

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6

Description: A Use of Hard-coded Credentials issue was discovered in the FTP server of the pump, where the credentials are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections.

Recommendations: For version 1.1, update the configuration to disable FTP connections until a fix is available. For version 1.5, restrict access to the FTP server to minimize the risk of exploitation. For version 1.6, consider disabling the FTP server functionality until a patch is available.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-12724

Produtos afetados

Medfusion 4000 Wireless Syringe Infusion Pump

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12724 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12724 · Aviso do Fabricante
• http://securityfocus.com/bid/100665 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Nota