CVE-2020-12039

Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed.

CVSS v3 2.4 LOW
CVSS v2.0 2.1 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.us-cert.gov/ics/advisories/icsma-20-170-04	Third Party Advisory US Government Resource
https://www.us-cert.gov/ics/advisories/icsma-20-170-04	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:baxter:sigma_spectrum_infusion_system_firmware::::::::
	cpe:2.3:o:baxter:sigma_spectrum_infusion_system_firmware:8.0:::::::*

cpe:2.3:h:baxter:sigma_spectrum_infusion_system:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:59

Type	Values Removed	Values Added
References	~~() https://www.us-cert.gov/ics/advisories/icsma-20-170-04 - Third Party Advisory, US Government Resource~~	() https://www.us-cert.gov/ics/advisories/icsma-20-170-04 - Third Party Advisory, US Government Resource

Information

Published : 2020-06-29 14:15

Updated : 2024-11-21 04:59

NVD link : CVE-2020-12039

Mitre link : CVE-2020-12039

CVE.ORG link : CVE-2020-12039

JSON object : View

Products Affected

baxter

sigma_spectrum_infusion_system
sigma_spectrum_infusion_system_firmware

CWE

CWE-259

Use of Hard-coded Password

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2020-12039", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "published": "2020-06-29T14:15:11.617", "references": [{"url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-259"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed."}, {"lang": "es", "value": "Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System versiones v's6.x modelo 35700BAX y Baxter Spectrum Infusion System versiones v's8.x modelo 35700BAX2, contienen contrase\u00f1as embebidas cuando se ingresan f\u00edsicamente en el teclado proporcionan acceso a men\u00fas biom\u00e9dicos que incluyen configuraciones de dispositivos, visualizar valores de calibraci\u00f3n, configuraci\u00f3n de red de Sigma Spectrum WBM si est\u00e1 instalado"}], "lastModified": "2024-11-21T04:59:09.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:baxter:sigma_spectrum_infusion_system_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FCC49AB-B0AD-44FF-ACEB-3C26EA4F2C3C", "versionEndIncluding": "6.05", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:baxter:sigma_spectrum_infusion_system_firmware:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72D0F7CB-3D24-4A8D-826D-ACB20ACBEB1C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:baxter:sigma_spectrum_infusion_system:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "49E25260-EC14-4E98-A86B-CBBE47E26AE5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}