PT-2018-5452 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Published 2018-02-15 · Updated 2018-03-02 · CVE-2017-12724

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6

Description: A Use of Hard-coded Credentials issue was discovered in the FTP server of the pump, where the credentials are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections.

Recommendations: For version 1.1, update the configuration to disable FTP connections until a fix is available. For version 1.5, restrict access to the FTP server to minimize the risk of exploitation. For version 1.6, consider disabling the FTP server functionality until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-12724

Affected Products

Medfusion 4000 Wireless Syringe Infusion Pump

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12724 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12724 · Vendor Advisory
• http://securityfocus.com/bid/100665 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Note