CVE-2022-26390

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

CVSS Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-311CWE-312

Affected Products (13)

baxter · spectrum_wireless_battery_module_firmwarevulnerable

baxter · spectrum_wireless_battery_module

baxter · sigma_spectrum_35700bax_firmwarevulnerable

baxter · sigma_spectrum_35700bax

baxter · sigma_spectrum_35700bax2_firmwarevulnerable

baxter · sigma_spectrum_35700bax2

baxter · baxter_spectrum_iq_35700bax3_firmwarevulnerable

baxter · baxter_spectrum_iq_35700bax3

References (3)

https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01

Third Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

Third Party AdvisoryUS Government Resource