CVE-2020-12035

Опубликовано: 29 июн. 2020

Источник: nvd

CVSS3: 4.9

CVSS2: 3.6

EPSS Низкий

Описание

Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provides access to biomedical information, device settings, calibration settings, and network configuration. This could allow an attacker to modify device settings and calibration.

Комментарий

At the time of analysis, information provided did not align with the data (including CVE number) in the advisory.

Ссылки

https://www.us-cert.gov/ics/advisories/icsma-20-170-01
Not Applicable
https://us-cert.cisa.gov/ics/advisories/icsma-20-170-02
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsma-20-170-01
Not Applicable

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:baxter:prismaflex_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:baxter:prismaflex:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:baxter:prismax_firmware:*:*:*:*:*:*:*:*

Версия до 3.0 (исключая)

cpe:2.3:h:baxter:prismax:-:*:*:*:*:*:*:*

EPSS

Процентиль: 15%

0.00047

Низкий

4.9 Medium

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-287

CWE-798

Связанные уязвимости

GHSA-g2x6-q2j8-7r2x

github

больше 3 лет назад