CVE-2014-5434

Published: Mar 26, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credentials used with the FTP protocol. Baxter asserts no files can be transferred to or from the WBM using this account. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8, which incorporates hardware and software changes.

Affected (1)

Products: Baxter: Sigma Spectrum Infusion System Firmware

1 product

Sigma Spectrum Infusion System Firmware

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Baxter Sigma Spectrum Infusion System Firmware	Version 6.05

Running on/with	Platform Versions
Baxter Sigma Spectrum Infusion System	All versions
Baxter Wireless Battery Module	Version 16

Related CWEs

Use of Hard-coded Password

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.