PT-2019-7130 · Baxter · Baxter Sigma Spectrum Infusion System

Published 2019-03-26 · Updated 2019-10-09 · CVE-2014-5434

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Baxter SIGMA Spectrum Infusion System version 6.05

Description The issue concerns a default account with hard-coded credentials used in conjunction with the FTP protocol. It is specified that no files can be transferred to or from the wireless battery module using this account.

Recommendations For Baxter SIGMA Spectrum Infusion System version 6.05, update to version 8, which incorporates necessary hardware and software changes to address the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-259

Related Identifiers

CVE-2014-5434

Affected Products

Baxter Sigma Spectrum Infusion System

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-5434 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01 · Note