VulnerabilityModified
CVE-2022-26390
An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
MEDIUM 4.2EPSS 0.47%
Does this matter?
Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.
Description
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
- CVSS 3.1
- 4.2 MEDIUMCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.47% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-311, CWE-312
- Affected
- baxter/spectrum wireless battery module firmware · baxter/sigma spectrum 35700bax firmware · baxter/sigma spectrum 35700bax2 firmware · baxter/baxter spectrum iq 35700bax3 firmware
- Source
- productsecurity@baxter.com
References
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxThird Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01Third Party Advisory, US Government Resource
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxThird Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.