Medium severity · published Feb 15, 2018
CVE-2017-12721
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
5.9
CVSS
0.7%
EPSS
No
On KEV
Description
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host certificates, leaving the pump vulnerable to a man-in-the-middle (MITM) attack.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M4
Medfusion 4000 Wireless Syringe Infusion Pump · Smiths-medical
1.1; 1.5; 1.6 · source: NVD
Affected product
M4
Medfusion 4000 Wireless Syringe Infusion Pump
Smiths-medical
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12721
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12721
Third Party Advisory
http://www.securityfocus.com/bid/100665
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A
More from Medfusion 4000 Wireless Syringe Infusion Pump
8.1
CVE-2017-12724
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
8.1
CVE-2017-12720
An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
8.1
CVE-2017-12718
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
7.3
CVE-2017-12726
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
5.6
CVE-2017-12725
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6