CVE-2017-12726 Hardcoded credentials in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump

High 7.3 Published 15 Feb 2018 Updated 5 Aug 2024

Hardcoded Telnet credentials allow unauthorized access to the communication module if external communications are enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-12726?

CVE-2017-12726 is a high-severity vulnerability in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, published on 15 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to allow external communications. Smiths Medical assesses that it is not possible to upload files via Telnet and the impact of this vulnerability is limited to the communications module.

Weakness: CWE-798

Which versions are affected by CVE-2017-12726?

It affects 1 product.

Products include Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump.

How do I fix CVE-2017-12726?

No fix has been published for CVE-2017-12726 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-12726 being exploited?

There is no known exploitation of CVE-2017-12726 in the wild and no public exploit code.

Sources

Also known as GHSA-qx9v-89v8-vq65.