CVE-2020-12047

EUVD-2020-4363 · Published Jun 29, 2020

The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless configuration enables an FTP service with hard-coded credentials.

Technologies

Baxter Wireless Battery ModuleBaxter Sigma Spectrum Infusion SystemBaxter Sigma Spectrum Infusion System Firmware

Weaknesses

CWE-798CWE-259

CVSS scores

v3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
v2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Privilege Escalation Stealth Credential Access

T1190Exploit Public-Facing Application T1078.001Default Accounts T1552.001Credentials In Files

References

https://www.us-cert.gov/ics/advisories/icsma-20-170-04

Potentially impacted assets

See if this affects your attack surface