CVE-2017-12725 Hardcoded credentials in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump

Medium 5.6 Published 15 Feb 2018 Updated 5 Aug 2024

Hard-coded credentials in the Medfusion 4000 pump allow attackers to bypass authentication and access network communications.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-12725?

CVE-2017-12725 is a medium-severity vulnerability in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, published on 15 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network configuration uses hard-coded credentials to automatically establish a wireless network connection. The pump will establish a wireless network connection even if the pump is Ethernet connected and active; however, if the wireless association is established and the Ethernet cable is attached, the pump does not attach the network stack to the wireless network. In this scenario, all network traffic is instead directed over the wired Ethernet connection.

Weakness: CWE-798

Which versions are affected by CVE-2017-12725?

It affects 1 product.

Products include Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump.

How do I fix CVE-2017-12725?

No fix has been published for CVE-2017-12725 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-12725 being exploited?

There is no known exploitation of CVE-2017-12725 in the wild and no public exploit code.

Sources

Also known as GHSA-chgj-p4c2-8wqj.