Vulnerabilities (CVE)

Filtered by vendor Smiths-medical Subscribe

Filtered by product Medfusion 4000 Wireless Syringe Infusion Pump

Total 8 CVE

CVE	Vendors	Products	Updated	CVSS v2	CVSS v3
CVE-2017-12726	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	7.5 HIGH	7.3 HIGH
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to allow external communications. Smiths Medical assesses that it is not possible to upload files via Telnet and the impact of this vulnerability is limited to the communications module.
CVE-2017-12725	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	6.8 MEDIUM	5.6 MEDIUM
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network configuration uses hard-coded credentials to automatically establish a wireless network connection. The pump will establish a wireless network connection even if the pump is Ethernet connected and active; however, if the wireless association is established and the Ethernet cable is attached, the pump does not attach the network stack to the wireless network. In this scenario, all network traffic is instead directed over the wired Ethernet connection.
CVE-2017-12724	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	6.8 MEDIUM	8.1 HIGH
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains hardcoded credentials, which are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections.
CVE-2017-12723	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	4.3 MEDIUM	3.7 LOW
A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stores some passwords in the configuration file, which are accessible if the pump is configured to allow external communications.
CVE-2017-12722	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	5.0 MEDIUM	5.3 MEDIUM
An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump reads memory out of bounds, causing the communications module to crash. Smiths Medical assesses that the crash of the communications module would not impact the operation of the therapeutic module.
CVE-2017-12721	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	4.3 MEDIUM	5.9 MEDIUM
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host certificates, leaving the pump vulnerable to a man-in-the-middle (MITM) attack.
CVE-2017-12720	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	6.8 MEDIUM	8.1 HIGH
An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.
CVE-2017-12718	1 Smiths-medical	1 Medfusion 4000 Wireless Syringe Infusion Pump	2024-11-21	6.8 MEDIUM	8.1 HIGH
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump does not verify input buffer size prior to copying, leading to a buffer overflow, allowing remote code execution on the target device. The pump receives the potentially malicious input infrequently and under certain conditions, increasing the difficulty of exploitation.