9.1

CVE-2020-12032

Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Baxter ≫ Em2400 Firmware Version1.10
   Baxter ≫ Em2400 Version-
Baxter ≫ Em2400 Firmware Version1.11
   Baxter ≫ Em2400 Version-
Baxter ≫ Em1200 Firmware Version1.1
   Baxter ≫ Em1200 Version-
Baxter ≫ Em1200 Firmware Version1.2
   Baxter ≫ Em1200 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.263
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

https://www.us-cert.gov/ics/advisories/icsma-20-170-01
Third Party Advisory
US Government Resource