CVE-2022-26390
Assigner: Baxter
Published: 2022-09-08T00:00:00
State: PUBLISHED
affected: product: Baxter Spectrum Wireless Battery Module (WBM)
vendor: Baxter
versions: status: affected
version: 16  
status: affected
version: 16D38  
status: affected
version: 17  
status: affected
version: 17D19  
status: affected
version: 20D29  
status: affected
version: 20D30  
status: affected
version: 20D31  
status: affected
version: 20D32  
status: affected
version: 22D19  
status: affected
version: 22D20  
status: affected
version: 22D21  
status: affected
version: 22D22  
status: affected
version: 22D23  
status: affected
version: 22D24  
status: affected
version: 22D25  
status: affected
version: 22D26  
status: affected
version: 22D27  
status: affected
version: 22D28  
datePublic: 2022-09-08T00:00:00
descriptions: value: The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
type: CWE
source: discovery: EXTERNAL
title: Unencrypted internal storage of security credentials
x_generator: engine: Vulnogram 0.0.9