PT-2020-13013 · Baxter · Baxter Spectrum Wbm+1

Published 2020-06-29 · Updated 2022-03-03 · CVE-2020-12047

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Baxter Spectrum WBM versions v17, v20D29, v20D30, v20D31, and v22D24 Baxter Spectrum v8.x (model 35700BAX2)

Description The issue concerns the Baxter Spectrum WBM and Baxter Spectrum v8.x, which enable an FTP service with hard-coded credentials when used together in a factory-default wireless configuration.

Recommendations For Baxter Spectrum WBM versions v17, v20D29, v20D30, v20D31, and v22D24, consider disabling the FTP service until a patch is available. For Baxter Spectrum v8.x (model 35700BAX2), restrict access to the factory-default wireless configuration to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

CVE-2020-12047

Affected Products

Baxter Spectrum

Baxter Spectrum Wbm

References · 5

• https://osv.dev/vulnerability/CVE-2020-12047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12047 · Security Note
• https://t.me/true_secator/2696 · Telegram Post
• https://t.me/cvenotify/4716 · Telegram Post
• https://us-cert.gov/ics/advisories/icsma-20-170-04 · Note