Baxter Sigma Spectrum Infusion Pumps (Update B)
Sigma Spectrum Infusion System Version(s) 6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) contain hard-coded passwords which, when physically entered on the keypad, provide access to biomedical menus that include device settings, view of calibration values, and network configuration of the Sigma Spectrum Wireless Battery Module (WBM) if installed. CVE-2020-12039 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Sigma Spectrum Infusion System Version(s) 6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) at the application layer uses an unauthenticated clear-text communication channel to send and receive system status and operational data. This could allow an attacker that has circumvented network security measures to view sensitive non-private data or to perform a man-in-the-middle attack. CVE-2020-12040 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The Baxter Spectrum WBM (v9, v11, v13, v14, v15, v16, v16D38, v17, v17D19, v20D29 to v20D32, and v22D19 to v22D28) operates a Telnet service with hard-coded credentials when connected to specific SSIDs. CVE-2020-12045 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). The Baxter Spectrum WBM (v9, v11, v13, v14, v15, v16, v16D38, v17, v17D19, v20D29 to v20D32, and v22D19 to v22D28) Telnet Command-Line Interface grants access to sensitive data stored on the WBM that permits temporary configuration changes to network settings of the WBM. This access allows the WBM to be rebooted. Temporary configuration changes to network settings are removed upon reboot. CVE-2020-12041 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). The factor-default wireless configuration of the Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32, and v22D19 to v22D28) enables File Transfer Protocol (FTP) service with hard-coded credentials. CVE-2020-12047 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). When configured for wireless networking, the Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32, and v22D19 to v22D28) enables FTP service operating on the WBM to remain operational until the WBM is rebooted. CVE-2020-12043 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).