CVE-2022-26390

Unencrypted internal storage of security credentials

State: Published
Severity: 4.2 Medium
Published: Sep 9, 2022
Updated: Sep 17, 2024
Reserved: Mar 3, 2022

Description

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	Baxter

Weaknesses

CWE-311 Missing Encryption of Sensitive Data

Affected Products

Product	Versions
Baxter Spectrum Wireless Battery Module (WBM)Baxter	16Affected 16D38Affected 17Affected 17D19Affected 20D29Affected 20D30Affected 20D31Affected 20D32Affected 22D19Affected 22D20Affected 22D21Affected 22D22Affected 22D23Affected 22D24Affected 22D25Affected 22D26Affected 22D27Affected 22D28Affected

References

https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.