PT-2022-24184 · Cms8000 · Cms8000

Published 2022-09-13 · Updated 2022-09-14 · CVE-2022-38069

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CMS8000 devices (affected versions not specified)

Description The issue concerns multiple globally default credentials existing across all CMS8000 devices. If these credentials are exposed, a threat actor with momentary physical access can gain privileged access to any device. This privileged access enables the extraction of sensitive patient information or modification of device parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-38069

Affected Products

Cms8000

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-38069 · Security Note
• https://t.me/cibsecurity/49640 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsma-22-244-01 · Note