CVE-2022-26390
Unencrypted internal storage of security credentials
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
Timeline
- CVE published
- Record last updated
Affected versions
- Baxter Baxter Spectrum Wireless Battery Module (WBM)
16, 16D38, 17, 17D19, 20D29, 20D30, 20D31, 20D32, 22D19, 22D20, 22D21, 22D22, 22D23, 22D24, 22D25, 22D26, 22D27, 22D28