PT-2018-5454 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Publicado 2018-02-15 · Atualizado 2018-03-02 · CVE-2017-12726

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, 1.6

Description: A Use of Hard-coded Password issue was discovered, where Telnet on the pump uses hardcoded credentials. This can be exploited if the pump is configured to allow external communications. The impact of this issue is limited to the communications module, as it is not possible to upload files via Telnet.

Recommendations: For versions 1.1, 1.5, and 1.6, consider restricting access to the Telnet service to minimize the risk of exploitation, as the hardcoded credentials can be used if the pump allows external communications.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-12726

Produtos afetados

Medfusion 4000 Wireless Syringe Infusion Pump

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-12726 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12726 · Nota de Segurança
• http://securityfocus.com/bid/100665 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Nota