CVE-2022-26390

—

CVSS 3.1

4.2 medium

EPSS

<1%p40

Published

Sep 9, 2022 (Sep 9, 2022)

Modified

Jun 17, 2026

Description

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

Vendors: baxter
Products: spectrum wireless battery module firmware, sigma spectrum 35700bax firmware, sigma spectrum 35700bax2 firmware, baxter spectrum iq 35700bax3 firmware
Weakness: CWE-311, CWE-312
Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news2 stories

New Vulnerabilities Reported in Baxter's Internet

The Hacker NewsSep 8, 17:55 UTC · Sep 8, 2022Vulnerability CVE-2022-26390 CVE-2022-26392 CVE-2022-26393+1 CVEs

Four vulnerabilities discovered in popular infusion pumps, WiFi batteries

The RecordJan 11, 00:00 UTC · Jan 11, 2023Vulnerability CVE-2022-26392 CVE-2022-26393 CVE-2022-26394+1 CVEs