PT-2020-13011 · Baxter · Baxter Spectrum Wbm+1

Published 2020-06-29 · Updated 2022-03-03 · CVE-2020-12045

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Baxter Spectrum WBM versions v17, v20D29, v20D30, v20D31, and v22D24 Baxter Spectrum v8.x (model 35700BAX2)

Description The Baxter Spectrum WBM, when used with a Baxter Spectrum v8.x, operates a Telnet service on Port 1023 with hard-coded credentials.

Recommendations For Baxter Spectrum WBM versions v17, v20D29, v20D30, v20D31, and v22D24, consider disabling the Telnet service on Port 1023 as a temporary workaround until a patch is available. For Baxter Spectrum v8.x (model 35700BAX2), restrict access to the Telnet service on Port 1023 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

CVE-2020-12045

Affected Products

Baxter Spectrum

Baxter Spectrum Wbm

References · 5

• https://osv.dev/vulnerability/CVE-2020-12045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12045 · Security Note
• https://t.me/true_secator/2696 · Telegram Post
• https://us-cert.gov/ics/advisories/icsma-20-170-04 · Note
• https://t.me/cvenotify/4715 · Telegram Post