CVE-2020-12020 Privilege escalation in Baxter ExactaMix EM 2400 & EM 1200
Non-administrative users can access the operating system and modify application startup scripts, leading to privilege escalation and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12020?
CVE-2020-12020 is a medium-severity vulnerability in Baxter ExactaMix EM 2400 & EM 1200, published on 29 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user.
Weakness: CWE-668
Which versions are affected by CVE-2020-12020?
It affects 2 products.
Products include Baxter Em1200 Firmware, Baxter Em2400 Firmware.
How do I fix CVE-2020-12020?
No fix has been published for CVE-2020-12020 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-12020 being exploited?
There is no known exploitation of CVE-2020-12020 in the wild and no public exploit code.
Other vulnerabilities in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12016 Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12032 Information disclosure in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12008 Information disclosure in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12012 Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12024 Missing authorization in Baxter ExactaMix EM 2400 & EM 1200
Sources
Also known as GHSA-4hrx-7xj9-j6h2.