Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.2
CVE-2022-26390: The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical acc...
CVE-2022-26390 · published 4 years ago
Summary
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive informati...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| baxter | spectrum_wireless_battery_module_firmware |
>= 20d29, <= 20d32 >= 22d19, <= 22d28 16 16d38 17 17d19 cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:*:*:*:*:*:*:*:* |
| baxter | sigma_spectrum_35700bax_firmware |
All versions
cpe:2.3:o:baxter:sigma_spectrum_35700bax_firmware:-:*:*:*:*:*:*:* |
| baxter | sigma_spectrum_35700bax2_firmware |
All versions
cpe:2.3:o:baxter:sigma_spectrum_35700bax2_firmware:-:*:*:*:*:*:*:* |
| baxter | baxter_spectrum_iq_35700bax3_firmware |
All versions
cpe:2.3:o:baxter:baxter_spectrum_iq_35700bax3_firmware:-:*:*:*:*:*:*:* |
Original advisory text
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical acc...
The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
References
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01 Third Party Advisory US Government Resource
- https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx Third Party Advisory US Government Resource
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-311Missing Encryption of Sensitive Data
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published9 Sep 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-26390 · NVD
Track software like this
Free during beta