CVE-2022-26390
Last modified
CVE-2022-26390 is a medium-severity vulnerability rated 4.2/10 on the CVSS scale. The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
Metrics
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Baxter | Spectrum Wireless Battery Module Firmware | >= 20d29, <= 20d32 |
| Baxter | Spectrum Wireless Battery Module Firmware | >= 22d19, <= 22d28 |
| Baxter | Spectrum Wireless Battery Module Firmware | 16 |
| Baxter | Spectrum Wireless Battery Module Firmware | 16d38 |
| Baxter | Spectrum Wireless Battery Module Firmware | 17 |
| Baxter | Spectrum Wireless Battery Module Firmware | 17d19 |
| Baxter | Sigma Spectrum 35700bax Firmware | All versions |
| Baxter | Sigma Spectrum 35700bax2 Firmware | All versions |
| Baxter | Baxter Spectrum Iq 35700bax3 Firmware | All versions |
References
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxThird Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01Third Party Advisory, US Government Resource
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxThird Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-26390?
How severe is CVE-2022-26390?
How do I fix CVE-2022-26390?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-26385In unusual circumstances, an individual thread may outlive t…6.5
- CVE-2022-26386Previously Firefox for macOS and Linux would download tempor…6.5
- CVE-2022-26387When installing an add-on, Firefox verified the signature be…7.5
- CVE-2022-26388A use of hard-coded password vulnerability may allow authent…6.4
- CVE-2022-26389An improper access control vulnerability may allow privilege…7.7
- CVE-2022-2639An integer coercion error was found in the openvswitch kerne…7.8
- CVE-2022-26392The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WB…6.5
- CVE-2022-26393The Baxter Spectrum WBM is susceptible to format string atta…8.1
- CVE-2022-26394The Baxter Spectrum WBM does not perform mutual authenticati…5.4
- CVE-2022-2640The Config-files of Horner Automation’s RCC 972 with firmwar…7.5
- CVE-2022-2641Horner Automation’s RCC 972 with firmware version 15.40 has …9.8
- CVE-2022-26413A command injection vulnerability in the CGI program of Zyxe…8
Are you affected by CVE-2022-26390?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST