Baxter

Latest CVEs · RSS

• CVE-2022-26389 2025-02-07 · CVSS 7.7
  An improper access control vulnerability may allow privilege escalation.This issue affects:  * ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prior
• CVE-2022-26388 2025-02-07 · CVSS 6.4
  A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prior; ELI
• CVE-2024-48967 2024-11-14 · CVSS 10.0
  The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. A
• CVE-2024-48966 2024-11-14 · CVSS 10.0
  The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC wh
• CVE-2024-48970 2024-11-14 · CVSS 9.3
  The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an of
• CVE-2024-48974 2024-11-14 · CVSS 9.3
  The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized change
• CVE-2024-48973 2024-11-14 · CVSS 9.3
  The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which
• CVE-2024-48971 2024-11-14 · CVSS 9.3
  The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the pas
• CVE-2024-9832 2024-11-14 · CVSS 9.3
  There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execut
• CVE-2024-9834 2024-11-14 · CVSS 9.3
  Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of inf
• CVE-2024-6796 2024-09-09 · CVSS 8.2
  In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker t
• CVE-2024-6795 2024-09-09 · CVSS 10.0
  In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthori
• CVE-2024-5176 2024-05-31 · CVSS 9.4
  Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects
• CVE-2024-1275 2024-05-31 · CVSS 9.1
  Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Wel
• CVE-2022-26393 2022-09-09 · CVSS 5.0
  The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensit
• CVE-2022-26390 2022-09-09 · CVSS 4.2
  The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypte
• CVE-2022-26392 2022-09-09 · CVSS 3.1
  The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via
• CVE-2022-26394 2022-09-09 · CVSS 5.5
  The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack th