CVE-2017-12720

—

CVSS 3.0

8.1 high

EPSS

2%p78

Published

Feb 15, 2018 (Feb 15, 2018)

Modified

Jun 17, 2026

Description

An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.

Vendors: smiths-medical
Products: medfusion 4000 wireless syringe infusion pump
Weakness: CWE-306
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news2 stories

Hackers can remotely access Smiths Medical Syringe Infusion Pumps to kill patients

Security AffairsSep 11, 08:44 UTC · Sep 11, 2017Vulnerability CVE-2017-12725 CVE-2017-12718 CVE-2017-12720+2 CVEs

Hackers Can Remotely Access Syringe Infusion Pumps to Deliver Fatal Overdoses

The Hacker NewsSep 9, 13:50 UTC · Sep 9, 2017Vulnerability CVE-2017-12725 CVE-2017-12718 CVE-2017-12720+2 CVEs