Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2017-12726: Medfusion 4000 pump allows telnet login with default password
CVE-2017-12726 · published 8 years ago
Summary
The Medfusion 4000 wireless syringe infusion pump (versions 1.1, 1.5, and 1.6) includes a telnet service that uses a hard‑coded username and password. If the device is set to accept external connections, anyone who can reach it could log in and interact with the communications module. To protect the pump, disable telnet or restrict network access to trusted systems and apply any available firmware updates.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| smiths-medical | medfusion_4000_wireless_syringe_infusion_pump |
1.1 1.5 1.6 cpe:2.3:o:smiths-medical:medfusion_4000_wireless_syringe_infusion_pump:1.1:*:*:*:*:*:*:* |
Original advisory text
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which ca...
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to allow external communications. Smiths Medical assesses that it is not possible to upload files via Telnet and the impact of this vulnerability is limited to the communications module.
References
- http://www.securityfocus.com/bid/100665 Third Party Advisory VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A Third Party Advisory US Government Resource
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published15 Feb 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-12726 · NVD
Track software like this
Free during beta