CVE-2020-12035 Hardcoded credentials in Baxter PrismaFlex and PrisMax
Hard-coded service password in Baxter PrismaFlex devices allows attackers to access and modify critical biomedical settings and calibration data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12035?
CVE-2020-12035 is a medium-severity vulnerability in Baxter PrismaFlex and PrisMax, published on 29 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provides access to biomedical information, device settings, calibration settings, and network configuration. This could allow an attacker to modify device settings and calibration.
Which versions are affected by CVE-2020-12035?
It affects 2 products.
Products include Baxter Prismaflex Firmware, Baxter Prismax Firmware.
How do I fix CVE-2020-12035?
No fix has been published for CVE-2020-12035 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-12035 being exploited?
There is no known exploitation of CVE-2020-12035 in the wild and no public exploit code.
Other vulnerabilities in Baxter PrismaFlex and PrisMax
Sources
Also known as GHSA-g2x6-q2j8-7r2x.