PT-2018-5454 · Smiths Medical · Medfusion 4000 Wireless Syringe Infusion Pump

Published 2018-02-15 · Updated 2018-03-02 · CVE-2017-12726

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump versions 1.1, 1.5, 1.6

Description: A Use of Hard-coded Password issue was discovered, where Telnet on the pump uses hardcoded credentials. This can be exploited if the pump is configured to allow external communications. The impact of this issue is limited to the communications module, as it is not possible to upload files via Telnet.

Recommendations: For versions 1.1, 1.5, and 1.6, consider restricting access to the Telnet service to minimize the risk of exploitation, as the hardcoded credentials can be used if the pump allows external communications.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-12726

Affected Products

Medfusion 4000 Wireless Syringe Infusion Pump

References · 4

• https://osv.dev/vulnerability/CVE-2017-12726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12726 · Security Note
• http://securityfocus.com/bid/100665 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A · Note