CVE-2022-26390: The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form

Description

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

CVSS vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Physical

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 41% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BS

Baxter Spectrum IQ 35700bax3 Firmware · Baxter

All versions, or not specified · source: NVD

SS

Sigma Spectrum 35700bax Firmware · Baxter

All versions, or not specified · source: NVD

SS

Sigma Spectrum 35700bax2 Firmware · Baxter

All versions, or not specified · source: NVD

SW

Spectrum Wireless Battery Module Firmware · Baxter

20d29 through 20d32; 22d19 through 22d28; 16; 16d38; 17; 17d19 · source: NVD