Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Vulnerabilities (Update A)
This updated advisory is a follow-up to the original advisory titled ICSMA-17-250-02 Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Vulnerabilities that was published September 7, 2017, on the NCCIC/ICS-CERT web site.
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-12726US | high7.3OT elevated | — | ||
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded cred… | ||||
| CVE-2017-12725US | medium5.6OT elevated | — | ||
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network confi… | ||||
| CVE-2017-12724US | high8.1OT elevated | — | ||
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains… | ||||
| CVE-2017-12723US | low3.7 | — | ||
A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stores some passwords in… | ||||
| CVE-2017-12722US | medium5.3 | — | ||
An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump read… | ||||
| CVE-2017-12721US | medium5.9 | — | ||
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host… | ||||
| CVE-2017-12720US | high8.1OT elevated | — | ||
An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not requ… | ||||
| CVE-2017-12718US | high8.1 | Exploit | ||
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump… | ||||
references
External citations — patches, advisories, analysis.
remediations (8)
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
- FixedMedfusion 4000 Wireless Syringe Infusion Pump
Email: info.asd@smiths-medical.com
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan