CVE-2020-12039 Hardcoded credentials in Baxter Sigma Spectrum Infusion Pumps
Hardcoded passwords allow physical attackers to access biomedical menus, view calibration values, and modify network configurations on Baxter infusion pumps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12039?
CVE-2020-12039 is a low-severity vulnerability in Baxter Sigma Spectrum Infusion Pumps, published on 29 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed.
Which versions are affected by CVE-2020-12039?
It affects 1 product.
Products include Baxter Sigma Spectrum Infusion System Firmware.
How do I fix CVE-2020-12039?
No fix has been published for CVE-2020-12039 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-12039 being exploited?
There is no known exploitation of CVE-2020-12039 in the wild and no public exploit code.
Other vulnerabilities in Baxter Sigma Spectrum Infusion Pumps
- CVE-2020-12040 Information disclosure in Baxter Sigma Spectrum Infusion Pumps
- CVE-2020-12043 Security feature bypass in Baxter Sigma Spectrum Infusion Pumps
- CVE-2020-12045 Hardcoded credentials in Baxter Sigma Spectrum Infusion Pumps
- CVE-2020-12047 Hardcoded credentials in Baxter Sigma Spectrum Infusion Pumps
- CVE-2014-5432 Auth bypass in SIGMA Spectrum Infusion System
Sources
Also known as GHSA-r4xc-rmm6-cf36.