Vulnerability-Lookup

CNVD-2021-21076

Vulnerability from cnvd - Published: 2021-03-23

Title

Baxter Spectrum WBM存在未明漏洞（CNVD-2021-21076）

Description

Baxter WBM和Baxter Spectrum都是美国百特（Baxter）公司的产品。Baxter WBM是一款用于Baxter产品的无线电池模块。Baxter Spectrum是一款输液泵。 Baxter Spectrum WBM中存在安全漏洞，攻击者可借助特制的请求利用该漏洞获取FTP服务的访问权限。

Severity

高

Formal description

厂商尚未提供漏洞修补方案，请关注厂商主页及时更新： https://www.baxter.com/

Reference

https://www.us-cert.gov/ics/advisories/icsma-20-170-04

Impacted products

Name
['Baxter Spectrum WBM 17', 'Baxter Spectrum WBM 20D29', 'Baxter Spectrum WBM 20D30', 'Baxter Spectrum WBM 20D31', 'Baxter Spectrum WBM 22D24']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-12043"
    }
  },
  "description": "Baxter WBM\u548cBaxter Spectrum\u90fd\u662f\u7f8e\u56fd\u767e\u7279\uff08Baxter\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Baxter WBM\u662f\u4e00\u6b3e\u7528\u4e8eBaxter\u4ea7\u54c1\u7684\u65e0\u7ebf\u7535\u6c60\u6a21\u5757\u3002Baxter Spectrum\u662f\u4e00\u6b3e\u8f93\u6db2\u6cf5\u3002\n\nBaxter Spectrum WBM\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6FTP\u670d\u52a1\u7684\u8bbf\u95ee\u6743\u9650\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttps://www.baxter.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-21076",
  "openTime": "2021-03-23",
  "products": {
    "product": [
      "Baxter Spectrum WBM 17",
      "Baxter Spectrum WBM 20D29",
      "Baxter Spectrum WBM 20D30",
      "Baxter Spectrum WBM 20D31",
      "Baxter Spectrum WBM 22D24"
    ]
  },
  "referenceLink": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04",
  "serverity": "\u9ad8",
  "submitTime": "2020-06-19",
  "title": "Baxter Spectrum WBM\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2021-21076\uff09"
}

CVE-2020-12043 (GCVE-0-2020-12043)

Vulnerability from cvelistv5 – Published: 2020-06-29 13:41 – Updated: 2024-08-04 11:48

Summary

The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted.

Severity

No CVSS data available.

CWE

CWE-672 - OPERATION ON A RESOURCE AFTER EXPIRATION OR RELEASE CWE-672

Assigner

icscert icscert root

References

1 reference

URL	Tags
https://www.us-cert.gov/ics/advisories/icsma-20-170-04	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Baxter Sigma Spectrum Infusion Pumps	Affected: Sigma Spectrum v6.x model 35700BAX, Baxter Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module v9,11,13,14,15,16,v20D29,v20D30,v20D31,v22D24, Baxter Spectrum v8.x with Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24,Baxter Spectrum Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24,Baxter Spectrum LVP v8.x w/Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:48:57.976Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Baxter Sigma Spectrum Infusion Pumps",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Sigma Spectrum v6.x model 35700BAX, Baxter Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module v9,11,13,14,15,16,v20D29,v20D30,v20D31,v22D24, Baxter Spectrum v8.x with Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24,Baxter Spectrum Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24,Baxter Spectrum LVP v8.x w/Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-672",
              "description": "OPERATION ON A RESOURCE AFTER EXPIRATION OR RELEASE CWE-672",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-29T13:41:42.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2020-12043",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Baxter Sigma Spectrum Infusion Pumps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Sigma Spectrum v6.x model 35700BAX, Baxter Spectrum v8.x model 35700BAX2,Sigma Spectrum v6.x with Wireless Battery Module v9,11,13,14,15,16,v20D29,v20D30,v20D31,v22D24, Baxter Spectrum v8.x with Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24,Baxter Spectrum Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24,Baxter Spectrum LVP v8.x w/Wireless Battery Module v17,v20D29,v20D30,v20D31,v22D24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "OPERATION ON A RESOURCE AFTER EXPIRATION OR RELEASE CWE-672"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04",
              "refsource": "MISC",
              "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-04"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2020-12043",
    "datePublished": "2020-06-29T13:41:42.000Z",
    "dateReserved": "2020-04-21T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:48:57.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2021-21076

CVE-2020-12043 (GCVE-0-2020-12043)

Tags

Sightings

Nomenclature

Related by attack behaviour