Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2017-12724: Medfusion 4000 pump FTP server allows default login
CVE-2017-12724 · published 8 years ago
Summary
The Medfusion 4000 wireless syringe infusion pump includes an FTP service that ships with a preset username and password. If the device is set to permit FTP connections, anyone who knows these default credentials could access the pump's file system. Disable FTP access or change the credentials to a strong, unique password to remove the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| smiths-medical | medfusion_4000_wireless_syringe_infusion_pump |
1.1 1.5 1.6 cpe:2.3:o:smiths-medical:medfusion_4000_wireless_syringe_infusion_pump:1.1:*:*:*:*:*:*:* |
Original advisory text
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains hardcoded creden...
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains hardcoded credentials, which are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections.
References
- http://www.securityfocus.com/bid/100665 Third Party Advisory VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A Third Party Advisory US Government Resource
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published15 Feb 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-12724 · NVD
Track software like this
Free during beta