cnvd - cnvd-2021-21081

CNVD-2021-21081

Vulnerability from cnvd - Published: 2021-03-23

Title

Baxter Sigma Spectrum Infusion System和Spectrum Infusion System信任管理问题漏洞

Description

Baxter Sigma Spectrum Infusion System和Baxter Spectrum Infusion System都是美国百特（Baxter）公司的一款输液泵。 Baxter Sigma Spectrum Infusion System 6.x版本（35700BAX型号）和Baxter Spectrum Infusion System 8.x版本（35700BAX2型号）中存在信任管理问题漏洞，该漏洞源于程序包含硬编码密码，攻击者可利用该漏洞访问生物医学菜单，包括设备设置，校准值视图以及Sigma Spectrum无线电池模块（WBM）的网络配置。

Severity

低

Formal description

厂商尚未提供漏洞修补方案，请关注厂商主页及时更新： https://www.baxter.com/

Reference

https://www.us-cert.gov/ics/advisories/icsma-20-170-04

Impacted products

Name
['Baxter SIGMA Spectrum Infusion System 6.（35700BAX型号）', 'Baxter Spectrum Infusion System 8.（35700BAX2型号）']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-12039"
    }
  },
  "description": "Baxter Sigma Spectrum Infusion System\u548cBaxter Spectrum Infusion System\u90fd\u662f\u7f8e\u56fd\u767e\u7279\uff08Baxter\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u8f93\u6db2\u6cf5\u3002\n\nBaxter Sigma Spectrum Infusion System 6.x\u7248\u672c\uff0835700BAX\u578b\u53f7\uff09\u548cBaxter Spectrum Infusion System 8.x\u7248\u672c\uff0835700BAX2\u578b\u53f7\uff09\u4e2d\u5b58\u5728\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5305\u542b\u786c\u7f16\u7801\u5bc6\u7801\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u751f\u7269\u533b\u5b66\u83dc\u5355\uff0c\u5305\u62ec\u8bbe\u5907\u8bbe\u7f6e\uff0c\u6821\u51c6\u503c\u89c6\u56fe\u4ee5\u53caSigma Spectrum\u65e0\u7ebf\u7535\u6c60\u6a21\u5757\uff08WBM\uff09\u7684\u7f51\u7edc\u914d\u7f6e\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttps://www.baxter.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-21081",
  "openTime": "2021-03-23",
  "products": {
    "product": [
      "Baxter SIGMA Spectrum Infusion System 6.*\uff0835700BAX\u578b\u53f7\uff09",
      "Baxter Spectrum Infusion System 8.*\uff0835700BAX2\u578b\u53f7\uff09"
    ]
  },
  "referenceLink": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04",
  "serverity": "\u4f4e",
  "submitTime": "2020-06-19",
  "title": "Baxter Sigma Spectrum Infusion System\u548cSpectrum Infusion System\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2020-12039 (GCVE-0-2020-12039)

Vulnerability from cvelistv5 – Published: 2020-06-29 13:45 – Updated: 2024-08-04 11:48

Summary

Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed.

Severity ?

No CVSS data available.

CWE

CWE-259

Assigner

icscert

References

URL

Tags

https://www.us-cert.gov/ics/advisories/icsma-20-170-04

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Baxter Sigma Spectrum Infusion Pumps	Affected: Sigma Spectrum v6.x model 35700BAX,Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module (WBM) v9,v11,v13,v14,v15,v16,v20D29,v20D30,v20D31,v22D24, Spectrum v8.x w/WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum LVP v8.x with WBM v17, v20D29,v20D30,v20D31,and v22D24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:48:58.109Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Baxter Sigma Spectrum Infusion Pumps",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Sigma Spectrum v6.x model 35700BAX,Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module (WBM) v9,v11,v13,v14,v15,v16,v20D29,v20D30,v20D31,v22D24, Spectrum v8.x w/WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum LVP v8.x with WBM v17, v20D29,v20D30,v20D31,and v22D24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v\u0027s6.x model 35700BAX \u0026 Baxter Spectrum Infusion System v\u0027s8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-29T13:45:48",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2020-12039",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Baxter Sigma Spectrum Infusion Pumps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Sigma Spectrum v6.x model 35700BAX,Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module (WBM) v9,v11,v13,v14,v15,v16,v20D29,v20D30,v20D31,v22D24, Spectrum v8.x w/WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum WBM v17,v20D29,v20D30,v20D31,v22D24,Spectrum LVP v8.x with WBM v17, v20D29,v20D30,v20D31,and v22D24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v\u0027s6.x model 35700BAX \u0026 Baxter Spectrum Infusion System v\u0027s8.x model 35700BAX2 contain hardcoded passwords when physically entered on the keypad provide access to biomedical menus including device settings, view calibration values, network configuration of Sigma Spectrum WBM if installed."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-259"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04",
              "refsource": "MISC",
              "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2020-12039",
    "datePublished": "2020-06-29T13:45:48",
    "dateReserved": "2020-04-21T00:00:00",
    "dateUpdated": "2024-08-04T11:48:58.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-21081

CVE-2020-12039 (GCVE-0-2020-12039)

Tags

Sightings

Nomenclature