PT-2020-12980 · Baxter · Baxter Exactamix Em1200+1

Published 2020-06-29 · Updated 2020-07-08 · CVE-2020-12008

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10 through 1.11 Baxter ExactaMix EM1200 versions 1.1 through 1.2

Description The systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with network access to view sensitive data including Protected Health Information (PHI).

Recommendations For Baxter ExactaMix EM 2400 versions 1.10 through 1.11, consider implementing encryption for communication between the system and the order entry system to protect sensitive data. For Baxter ExactaMix EM1200 versions 1.1 through 1.2, consider implementing encryption for communication between the system and the order entry system to protect sensitive data. As a temporary workaround, consider restricting network access to the systems to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-12008

Affected Products

Baxter Exactamix Em 2400

Baxter Exactamix Em1200

References · 4

• https://osv.dev/vulnerability/CVE-2020-12008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12008 · Security Note
• https://t.me/cvenotify/4702 · Telegram Post
• https://us-cert.gov/ics/advisories/icsma-20-170-01 · Note