CVE-2020-12040

Published: Jun 29, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Sigma Spectrum Infusion System v's6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) at the application layer uses an unauthenticated clear-text communication channel to send and receive system status and operational data. This could allow an attacker that has circumvented network security measures to view sensitive non-private data or to perform a man-in-the-middle attack.

Affected (2)

Products: Baxter: Sigma Spectrum Infusion System Firmware

1 product

Sigma Spectrum Infusion System Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Baxter Sigma Spectrum Infusion System Firmware	From 6.0 to 6.05
Baxter Sigma Spectrum Infusion System Firmware	Version 8.0

Running on/with	Platform Versions
Baxter Sigma Spectrum Infusion System	All versions

Related CWEs

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (2)

https://www.us-cert.gov/ics/advisories/icsma-20-170-04

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsma-20-170-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.