PT-2019-7127 · Baxter · Baxter Sigma Spectrum Infusion System

Publicado 2019-03-26 · Atualizado 2019-10-09 · CVE-2014-5431

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Baxter SIGMA Spectrum Infusion System version 6.05

Description The issue concerns a hard-coded password in the wireless battery module of the Baxter SIGMA Spectrum Infusion System. This password provides access to basic biomedical information, limited device settings, and network configuration. An attacker with physical access to the device could use this password to make unauthorized configuration changes, such as turning wireless connections on or off and modifying the phase-complete audible alarm.

Recommendations For Baxter SIGMA Spectrum Infusion System version 6.05, update to version 8, which incorporates necessary hardware and software changes to address the issue.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-259

Identificadores relacionados

CVE-2014-5431

Produtos afetados

Baxter Sigma Spectrum Infusion System

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-5431 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01 · Nota