2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2022-26390" ,
"sourceIdentifier" : "productsecurity@baxter.com" ,
"published" : "2022-09-09T15:15:09.453" ,
2023-07-11 16:02:29 +00:00
"lastModified" : "2023-07-11T14:40:52.453" ,
2023-04-24 12:24:31 +02:00
"vulnStatus" : "Analyzed" ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information."
} ,
{
"lang" : "es" ,
"value" : "El M\u00f3dulo de Bater\u00eda Inal\u00e1mbrica (WBM) de Baxter Spectrum almacena credenciales de red y PHI (s\u00f3lo aplicable a las bombas Spectrum IQ que usan programaci\u00f3n autom\u00e1tica) de forma no cifrada. Un atacante con acceso f\u00edsico a un dispositivo al que no le han sido borrados todos los datos y configuraciones puede ser capaz de extraer informaci\u00f3n confidencial"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" ,
"attackVector" : "PHYSICAL" ,
"attackComplexity" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 4.2 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 0.5 ,
"impactScore" : 3.6
} ,
{
"source" : "productsecurity@baxter.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" ,
"attackVector" : "PHYSICAL" ,
"attackComplexity" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 4.2 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 0.5 ,
"impactScore" : 3.6
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
2023-07-11 16:02:29 +00:00
"value" : "CWE-312"
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"source" : "productsecurity@baxter.com" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-311"
}
]
}
] ,
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "20d29" ,
"versionEndIncluding" : "20d32" ,
"matchCriteriaId" : "34DB00B2-DE3D-4D7B-9F03-35060096C37C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "22d19" ,
"versionEndIncluding" : "22d28" ,
"matchCriteriaId" : "87121F24-64BD-4D6D-8467-5FBCCE0512C1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "719496E8-9020-456F-8CCC-FDFE10CF2820"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16d38:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "03DA9071-305A-4319-9807-1BD6F9EB8FDB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4C68B374-58AD-4E71-9B83-3CA0241B8A4A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17d19:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "85202DB1-56E1-43C6-81BC-C141862D72C0"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:baxter:spectrum_wireless_battery_module:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "15E8AA9C-1024-482D-8636-551486698A8C"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:sigma_spectrum_35700bax_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "1354B2D0-A259-4832-BB3D-BD9C157FB5C0"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:baxter:sigma_spectrum_35700bax:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2EAFF022-6879-4734-9AEB-DE45E6E235DE"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:sigma_spectrum_35700bax2_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E2715381-CA8F-416B-B9AD-9CDBDC181338"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:baxter:sigma_spectrum_35700bax2:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "576C9566-DA3F-43E8-B4E8-C5DEF3B06696"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:baxter:baxter_spectrum_iq_35700bax3_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "89AFD13D-97D8-40A5-B36B-9B65229302B1"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:baxter:baxter_spectrum_iq_35700bax3:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "71D6364A-9707-4BB0-8808-AF3314026A79"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01" ,
"source" : "nvd@nist.gov" ,
"tags" : [
"Third Party Advisory" ,
"US Government Resource"
]
} ,
{
"url" : "https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx" ,
"source" : "productsecurity@baxter.com" ,
"tags" : [
"Third Party Advisory" ,
"US Government Resource"
]
}
]
}
