CVE-2022-26390

low-risk

Published 2022-09-09

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.2/10 Medium

PHYSICAL / HIGH complexity

Affected Products (8)

Spectrum Wireless Battery Module Firmware

Sigma Spectrum 35700Bax Firmware

Sigma Spectrum 35700Bax2 Firmware

Baxter Spectrum Iq 35700Bax3 Firmware

Affected Vendors

Baxter

References (3)

Third Party Advisory https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01

Third Party Advisory https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

/ 100

low-risk

Severity 11/34 · Low

Exploitability 0/34 · Minimal

Exposure 14/34 · Moderate