CVE-2014-5431
published 2019-03-26CVE-2014-5431: Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which…
PriorityP429medium6.8CVSS 3.0
AVPACLPRNUINSUCHIHAH
EPSS
0.38%
29.6th percentile
Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provides access to basic biomedical information, limited device settings, and network configuration of the WBM, if connected. The hard-coded password may allow an attacker with physical access to the device to access management functions to make unauthorized configuration changes to biomedical settings such as turn on and off wireless connections and the phase-complete audible alarm that indicates the end of an infusion phase. Baxter has released a new version of the SIGMA Spectrum Infusion System, version 8, which incorporates hardware and software changes.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| baxter | sigma_spectrum_infusion_system | — | — |
| baxter | sigma_spectrum_infusion_system_firmware | — | — |
CVSS provenance
nvdv3.06.8MEDIUMCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2wv9-4g7m-79pc: Baxter SIGMA Spectrum Infusion System version 6
ghsa_unreviewed·2022-05-13
CVE-2014-5431 [MEDIUM] CWE-798 GHSA-2wv9-4g7m-79pc: Baxter SIGMA Spectrum Infusion System version 6
Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provides access to basic biomedical information, limited device settings, and network configuration of the WBM, if connected. The hard-coded password may allow an attacker with physical access to the device to access management functions to make unauthorized configuration changes to biomedical settings such as turn on and off wireless connections and the phase-complete audible alarm that indicates the end of an infusion phase. Baxter has released a new version of the SIGMA Spectrum Infusion System, version 8, which incorporates hardware and software changes.
CISA ICS
Baxter SIGMA Spectrum Infusion System Vulnerabilities
cisa_ics·2015-09-29
Baxter SIGMA Spectrum Infusion System Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Baxter SIGMA Spectrum Infusion System Vulnerabilities
Last RevisedSeptember 29, 2015
Alert CodeICSA-15-181-01
## OVERVIEW
This advisory was originally posted to the US-CERT secure Portal library on June 30, 2015, and is being released to the NCCIC/ICS-CERT web site.
Researcher Jared Bird with Allina IS Security identified four vulnerabilities in Baxter’s SIGMA Spectrum Infusion System. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8 that incorporates hardware and software changes, which do not contain three of the four identified vulnerabiliti
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-03-26
Published