All CISA Advisories, EN

Baxter Welch Allyn Connex Spot Monitor

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 9.1
  • ATTENTION: Exploitable remotely
  • Vendor: Baxter
  • Equipment: Welch Allyn Connex Spot Monitor (CSM)
  • Vulnerability: Use of Default Cryptographic Key

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to modify device configuration and firmware data. Tampering with this data could lead to device compromise, resulting in impact and/or delay in patient care.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Baxter (formerly manufactured by Hillrom) medical devices are affected:

  • Welch Allyn Connex Spot Monitor (CSM): Versions 1.52 and prior

3.2 Vulnerability Overview

3.2.1 USE OF DEFAULT CRYPTOGRAPHIC KEY CWE-1394

The impacted product uses a default cryptographic key for potentially critical functionality. An attacker could modify device configurations and firmware data, resulting in impact and/or delay in patient care

CVE-2024-1275 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2024-1275. A base score of 9.1 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
  • COUNTRIE

    […]
    Content was cut in order to protect the source.Please visit the source for the rest of the article.

    This article has been indexed from All CISA Advisories

    Read the original article: