productsecurity@baxter.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS productsecurity@baxter.com
03
assessed vulnerabilities (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-26389US | — | — | ||
An improper access control vulnerability may allow privilege escalation.This issue affects:
* ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior;
* ELI 280/BUR2… | ||||
| CVE-2022-26388US | —OT elevated | — | ||
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 28… | ||||
| CVE-2024-48974US | —OT elevated | — | ||
The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's co… | ||||
| CVE-2024-48973US | — | — | ||
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see… | ||||
| CVE-2024-48971US | —OT elevated | — | ||
The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventil… | ||||
| CVE-2024-48970US | — | — | ||
The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debuggin… | ||||
| CVE-2024-48967US | — | — | ||
The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with acce… | ||||
| CVE-2024-48966US | —OT elevated | — | ||
The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are in… | ||||
| CVE-2024-9834US | —OT elevated | — | ||
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have… | ||||
| CVE-2024-9832US | — | — | ||
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force atta… | ||||
| CVE-2024-6796US | critical9.1 | — | ||
In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized… | ||||
| CVE-2024-6795US | critical9.8 | — | ||
In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex… | ||||
| CVE-2024-5176US | — | — | ||
Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configu… | ||||
| CVE-2024-1275US | — | — | ||
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot… | ||||
| CVE-2022-26394US | medium5.4OT elevated | — | ||
The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies paramete… | ||||
| CVE-2022-26393US | high8.1 | — | ||
The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or c… | ||||
| CVE-2022-26392US | medium6.5 | — | ||
The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messagi… | ||||
| CVE-2022-26390US | medium4.2OT elevated | — | ||
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker… | ||||