PT-2020-12982 · Baxter · Baxter Exactamix Em 2400+1

Published 2020-06-29 · Updated 2020-07-07 · CVE-2020-12012

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Baxter ExactaMix EM 2400 versions 1.10 through 1.14 Baxter ExactaMix EM 1200 versions 1.1 through 1.5

Description The ExactaMix application has hard-coded administrative account credentials. Successful exploitation of this issue may allow an attacker with physical access to gain unauthorized access to view or update system configuration or data, potentially impacting confidentiality and integrity and risking exposure of sensitive information, including Protected Health Information (PHI).

Recommendations For Baxter ExactaMix EM 2400 versions 1.10 through 1.14, consider changing the hard-coded administrative account credentials to unique, secure credentials. For Baxter ExactaMix EM 1200 versions 1.1 through 1.5, consider changing the hard-coded administrative account credentials to unique, secure credentials. As a temporary workaround, restrict physical access to the system to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

CVE-2020-12012

Affected Products

Baxter Exactamix Em1200

Baxter Exactamix Em 2400

References · 4

• https://osv.dev/vulnerability/CVE-2020-12012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12012 · Security Note
• https://t.me/cvenotify/4703 · Telegram Post
• https://us-cert.gov/ics/advisories/icsma-20-170-01 · Note