Sign-up

ID

VAR-202006-0367


CVE

CVE-2020-12012


TITLE

Baxter ExactaMix EM 2400 and EM 1200 Vulnerability in using hard-coded credentials in

Trust: 0.8

sources: JVNDB: JVNDB-2020-007409

DESCRIPTION

Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13, and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 have hard-coded administrative account credentials for the ExactaMix application. Successful exploitation of this vulnerability may allow an attacker with physical access to gain unauthorized access to view/update system configuration or data. This could impact confidentiality and integrity of the system and risk exposure of sensitive information including PHI. Baxter ExactaMix EM2400 and ExactaMix EM1200 are both an automated drug mixing system of Baxter, USA. There is a trust management vulnerability in Baxter ExactaMix EM2400 and ExactaMix EM1200. The vulnerability stems from the fact that the ExactaMix application uses hard-coded management account credentials

Trust: 2.16

sources: NVD: CVE-2020-12012 // JVNDB: JVNDB-2020-007409 // CNVD: CNVD-2021-21074

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-21074

AFFECTED PRODUCTS

vendor:baxtermodel:exactamix em1200scope:eqversion:1.1

Trust: 1.4

vendor:baxtermodel:exactamix em1200scope:eqversion:1.2

Trust: 1.4

vendor:baxtermodel:exactamix em1200scope:eqversion:1.4

Trust: 1.4

vendor:baxtermodel:em1200scope:eqversion:1.2

Trust: 1.0

vendor:baxtermodel:em1200scope:eqversion:1.4

Trust: 1.0

vendor:baxtermodel:em2400scope:eqversion:1.14

Trust: 1.0

vendor:baxtermodel:em1200scope:eqversion:1.1

Trust: 1.0

vendor:baxtermodel:em2400scope:eqversion:1.13

Trust: 1.0

vendor:baxtermodel:em1200scope:eqversion:1.5

Trust: 1.0

vendor:baxtermodel:em2400scope:eqversion:1.10

Trust: 1.0

vendor:baxtermodel:em2400scope:eqversion:1.11

Trust: 1.0

vendor:baxtermodel:exactamix em1200scope:eqversion:1.5

Trust: 0.8

vendor:baxtermodel:exactamix em2400scope:eqversion:1.10

Trust: 0.8

vendor:baxtermodel:exactamix em2400scope:eqversion:1.11

Trust: 0.8

vendor:baxtermodel:exactamix em2400scope:eqversion:1.13

Trust: 0.8

vendor:baxtermodel:exactamix em2400scope:eqversion:1.14

Trust: 0.8

vendor:baxtermodel:exactamix emscope:eqversion:24001.10

Trust: 0.6

vendor:baxtermodel:exactamix emscope:eqversion:24001.11

Trust: 0.6

vendor:baxtermodel:exactamix emscope:eqversion:24001.13

Trust: 0.6

sources: CNVD: CNVD-2021-21074 // JVNDB: JVNDB-2020-007409 // NVD: CVE-2020-12012

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-12012
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2020-007409
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2021-21074
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202006-1270
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2020-12012
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-007409
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2021-21074
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-12012
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.9
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-007409
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-21074 // JVNDB: JVNDB-2020-007409 // CNNVD: CNNVD-202006-1270 // NVD: CVE-2020-12012

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.8

problemtype:CWE-259

Trust: 1.0

sources: JVNDB: JVNDB-2020-007409 // NVD: CVE-2020-12012

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202006-1270

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-007409

PATCH
title:Top Pageurl:https://www.baxter.com/
Trust: 0.8
title:Patch for Baxter ExactaMix EM2400 and ExactaMix EM1200 Trust Management Vulnerability (CNVD-2021-21074)url:https://www.cnvd.org.cn/patchInfo/show/254336
Trust: 0.6
title:Baxter ExactaMix EM2400  and EM1200 Repair measures for trust management problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=123263
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2021-21074 // 
            
            
            
            JVNDB: JVNDB-2020-007409 // 
            
            
            
            CNNVD: CNNVD-202006-1270

EXTERNAL IDS
db:ICS CERTid:ICSMA-20-170-01
Trust: 3.0
db:NVDid:CVE-2020-12012
Trust: 3.0
db:JVNid:JVNVU91499991
Trust: 0.8
db:JVNDBid:JVNDB-2020-007409
Trust: 0.8
db:CNVDid:CNVD-2021-21074
Trust: 0.6
db:NSFOCUSid:47276
Trust: 0.6
db:CNNVDid:CNNVD-202006-1270
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2021-21074 // 
            
            
            
            JVNDB: JVNDB-2020-007409 // 
            
            
            
            CNNVD: CNNVD-202006-1270 // 
            
            
            
            NVD: CVE-2020-12012

REFERENCES
url:https://www.us-cert.gov/ics/advisories/icsma-20-170-01
Trust: 2.2
url:https://nvd.nist.gov/vuln/detail/cve-2020-12012
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-12012
Trust: 0.8
url:https://us-cert.cisa.gov/ics/advisories/icsma-20-170-01
Trust: 0.8
url:https://jvn.jp/vu/jvnvu91499991/
Trust: 0.8
url:http://www.nsfocus.net/vulndb/47276
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2021-21074 // 
            
            
            
            JVNDB: JVNDB-2020-007409 // 
            
            
            
            CNNVD: CNNVD-202006-1270 // 
            
            
            
            NVD: CVE-2020-12012

CREDITS
Baxter
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202006-1270

SOURCES
db:CNVDid:CNVD-2021-21074
db:JVNDBid:JVNDB-2020-007409
db:CNNVDid:CNNVD-202006-1270
db:NVDid:CVE-2020-12012

LAST UPDATE DATE
2024-11-23T20:46:45.378000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2021-21074date:2021-03-23T00:00:00
db:JVNDBid:JVNDB-2020-007409date:2020-08-12T00:00:00
db:CNNVDid:CNNVD-202006-1270date:2020-07-28T00:00:00
db:NVDid:CVE-2020-12012date:2024-11-21T04:59:06.800

SOURCES RELEASE DATE
db:CNVDid:CNVD-2021-21074date:2021-03-23T00:00:00
db:JVNDBid:JVNDB-2020-007409date:2020-08-12T00:00:00
db:CNNVDid:CNNVD-202006-1270date:2020-06-18T00:00:00
db:NVDid:CVE-2020-12012date:2020-06-29T14:15:11.053