PT-2018-5448 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Published 2018-02-15 · Updated 2019-10-03 · CVE-2017-12720

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6

Description: An issue with improper access control was found. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.

Recommendations: For version 1.1, consider disabling FTP connections until a fix is available. For version 1.5, restrict access to the FTP server to minimize the risk of exploitation. For version 1.6, avoid using the FTP server until the issue is resolved.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2017-12720

Affected Products

Medfusion 4000 Wireless Syringe Infusion Pump

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12720 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12720 · Vendor Advisory
• http://securityfocus.com/bid/100665 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Note