CVE-2020-12008 Information disclosure in Baxter ExactaMix EM 2400 & EM 1200
An attacker with network access can view sensitive patient data transmitted in cleartext by Baxter ExactaMix systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12008?
CVE-2020-12008 is a high-severity vulnerability in Baxter ExactaMix EM 2400 & EM 1200, published on 29 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with network access to view sensitive data including PHI.
Weakness: CWE-319
Which versions are affected by CVE-2020-12008?
It affects 2 products.
Products include Baxter Em1200 Firmware, Baxter Em2400 Firmware.
How do I fix CVE-2020-12008?
No fix has been published for CVE-2020-12008 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-12008 being exploited?
There is no known exploitation of CVE-2020-12008 in the wild and no public exploit code.
Other vulnerabilities in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12016 Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12032 Information disclosure in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12012 Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12020 Privilege escalation in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12024 Missing authorization in Baxter ExactaMix EM 2400 & EM 1200
Sources
Also known as GHSA-pq8r-49xc-839h.