CVE-2020-12032 Information disclosure in Baxter ExactaMix EM 2400 & EM 1200
Attackers with network access can view or modify sensitive patient data stored in an unencrypted database on Baxter ExactaMix systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12032?
CVE-2020-12032 is a critical vulnerability in Baxter ExactaMix EM 2400 & EM 1200, published on 29 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI.
Which versions are affected by CVE-2020-12032?
It affects 2 products.
Products include Baxter Em1200 Firmware, Baxter Em2400 Firmware.
How do I fix CVE-2020-12032?
No fix has been published for CVE-2020-12032 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-12032 being exploited?
There is no known exploitation of CVE-2020-12032 in the wild and no public exploit code.
Other vulnerabilities in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12016 Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12008 Information disclosure in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12012 Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12020 Privilege escalation in Baxter ExactaMix EM 2400 & EM 1200
- CVE-2020-12024 Missing authorization in Baxter ExactaMix EM 2400 & EM 1200
Sources
Also known as GHSA-jv9r-mgx5-pqq6.