PT-2018-5453 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Published 2018-02-15 · Updated 2018-03-02 · CVE-2017-12725

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, and 1.6

Description: A Use of Hard-coded Credentials issue was discovered in the pump, where it uses hard-coded credentials to automatically establish a wireless network connection with its default network configuration. The pump will establish this connection even if it is connected and active via Ethernet. However, if the wireless association is established and the Ethernet cable is then attached, the pump directs all network traffic over the wired Ethernet connection instead.

Recommendations: For version 1.1, update the network configuration to avoid using hard-coded credentials. For version 1.5, change the default network settings to prevent automatic wireless network connections. For version 1.6, modify the pump's settings to prioritize Ethernet connections over wireless when both are available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-12725

Affected Products

Medfusion 4000 Wireless Syringe Infusion Pump

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12725 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12725 · Vendor Advisory
• http://securityfocus.com/bid/100665 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Note