PT-2018-5453 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Publicado 2018-02-15 · Atualizado 2018-03-02 · CVE-2017-12725

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6

Description: A Use of Hard-coded Credentials issue was discovered in the pump, where it uses hard-coded credentials to automatically establish a wireless network connection with its default network configuration. The pump will establish this connection even if it is connected and active via Ethernet. However, if the wireless association is established and the Ethernet cable is then attached, the pump directs all network traffic over the wired Ethernet connection instead.

Recommendations: For version 1.1, update the network configuration to avoid using hard-coded credentials. For version 1.5, change the default network settings to prevent automatic wireless network connections. For version 1.6, modify the pump's settings to prioritize Ethernet connections over wireless when both are available.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-12725

Produtos afetados

Medfusion 4000 Wireless Syringe Infusion Pump

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12725 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12725 · Aviso do Fabricante
• http://securityfocus.com/bid/100665 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Nota