CVE-2022-26393
highpriority · track · 32EPSS 0.007 · 52 %ileEUUSEPSS · scored 2026-10-27
The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedBaxter Spectrum IQcisa_csaf_ot
According to Baxter, software updates to disable Telnet and FTP (CVE-2022-26392) are in process. Software updates addressing the format string attack (CVE-2022-26393) are included in WBM version 20D30 and all other WBM versions authentication is already available in Spectrum IQ (CVE-2022-26394). Instructions to erase all data and settings on WBMs and pumps before decommissioning and transferring to other facilities (CVE-2022-26390) are in process for incorporation into the Spectrum Operator's Manual.
- FixedBaxter Spectrum IQ LVPcisa_csaf_ot
According to Baxter, software updates to disable Telnet and FTP (CVE-2022-26392) are in process. Software updates addressing the format string attack (CVE-2022-26393) are included in WBM version 20D30 and all other WBM versions authentication is already available in Spectrum IQ (CVE-2022-26394). Instructions to erase all data and settings on WBMs and pumps before decommissioning and transferring to other facilities (CVE-2022-26390) are in process for incorporation into the Spectrum Operator's Manual.
- FixedSigma Spectrumcisa_csaf_ot
According to Baxter, software updates to disable Telnet and FTP (CVE-2022-26392) are in process. Software updates addressing the format string attack (CVE-2022-26393) are included in WBM version 20D30 and all other WBM versions authentication is already available in Spectrum IQ (CVE-2022-26394). Instructions to erase all data and settings on WBMs and pumps before decommissioning and transferring to other facilities (CVE-2022-26390) are in process for incorporation into the Spectrum Operator's Manual.
- FixedSigma Spectrum LVPcisa_csaf_ot
According to Baxter, software updates to disable Telnet and FTP (CVE-2022-26392) are in process. Software updates addressing the format string attack (CVE-2022-26393) are included in WBM version 20D30 and all other WBM versions authentication is already available in Spectrum IQ (CVE-2022-26394). Instructions to erase all data and settings on WBMs and pumps before decommissioning and transferring to other facilities (CVE-2022-26390) are in process for incorporation into the Spectrum Operator's Manual.
- MitigationBaxter Spectrum IQcisa_csaf_ot
As a last resort, users may disable wireless operation of the pump; the Spectrum Infusion System was designed to operate without network access. This action would impact an organization’s ability to rapidly deploy drug library (formulary) updates to their pumps.
- MitigationBaxter Spectrum IQ LVPcisa_csaf_ot
As a last resort, users may disable wireless operation of the pump; the Spectrum Infusion System was designed to operate without network access. This action would impact an organization’s ability to rapidly deploy drug library (formulary) updates to their pumps.
- MitigationSigma Spectrumcisa_csaf_ot
As a last resort, users may disable wireless operation of the pump; the Spectrum Infusion System was designed to operate without network access. This action would impact an organization’s ability to rapidly deploy drug library (formulary) updates to their pumps.
- MitigationSigma Spectrum LVPcisa_csaf_ot
As a last resort, users may disable wireless operation of the pump; the Spectrum Infusion System was designed to operate without network access. This action would impact an organization’s ability to rapidly deploy drug library (formulary) updates to their pumps.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (16)
Products and version ranges known to be affected.
- Baxter Baxter Spectrum IQ LVP≤ 9.x (with Wireless Battery Modules >= 22D19 | <= v22D28)cisa_csaf_otUS
- Baxter Sigma Spectrum LVP≤ 8.x (Wireless Battery Modules v17 | v17D19 >= 20D29 | <= 20D32 | >= 22D24 | <= 22D28)cisa_csaf_otUS
- Baxter Sigma Spectrum LVP≤ 6.x (Wireless Battery Modules (16 | 16D38 | 17 | 17D19 | >= 20D29 | <= v20D32 | >= 22D24 | <= v22D28)cisa_csaf_otUS
- baxter baxter spectrum iq 35700bax3 firmwareall versionsnvdUScpe:2.3:o:baxter:baxter_spectrum_iq_35700bax3_firmware:*:*:*:*:*:*:*:*
- baxter sigma spectrum 35700bax firmwareall versionsnvdUScpe:2.3:o:baxter:sigma_spectrum_35700bax_firmware:*:*:*:*:*:*:*:*
- baxter sigma spectrum 35700bax2 firmwareall versionsnvdUScpe:2.3:o:baxter:sigma_spectrum_35700bax2_firmware:*:*:*:*:*:*:*:*
- baxter spectrum wireless battery module firmware= 20d29nvdUScpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSMA-22-251-01Baxter Sigma Spectrum Infusion Pump (Update A)2022-09-08icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in access to sensitive data and alteration of system configuration.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-26393/cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsma-22-251-01cnnvd
- https://www.baxter.com/product-security#additionalresourcesPatchcnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01cnnvd
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxcnnvd
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxenisa_euvd
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01Third Party AdvisoryUS Government Resourcenvd
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxBroken Linknvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan