PT-2018-5449 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Published 2018-02-15 · Updated 2018-03-02 · CVE-2017-12721

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6

Description: An issue with improper certificate validation was found, which could allow a man-in-the-middle (MITM) attack. The pump fails to validate host certificates.

Recommendations: For version 1.1, update the certificate validation mechanism to prevent MITM attacks. For version 1.5, ensure proper host certificate validation is implemented to secure the connection. For version 1.6, modify the certificate validation process to verify the authenticity of host certificates and prevent unauthorized access.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-12721

Affected Products

Medfusion 4000 Wireless Syringe Infusion Pump

References · 4

• https://osv.dev/vulnerability/CVE-2017-12721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12721 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Note
• http://securityfocus.com/bid/100665 · Note