Vulnerability in Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump
CVE-2017-12725
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network configuration uses hard-coded credentials to automatically establish a wireless network connection. The pump will establish a wireless network connection even if the pump is Ethernet connected and active; however, if the wireless association is established and the Ethernet cable is attached, the pump does not attach the network stack to the wireless network. In this scenario, all network traffic is instead directed over the wired Ethernet connection.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.008 (56.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump — versions 1.1, 1.5, 1.6
- Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump — versions Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
Weakness classification (CWE)
References
- ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A (US Government Resource, Third Party Advisory)
- www.securityfocus.com/bid/100665 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2017-12725?
- CVE-2017-12725 is a medium-severity vulnerability in Smiths-Medical Medfusion 4000 Wireless Syringe Infusion Pump, classified under Use of Hard-coded Credentials. CVSS score: 5.6/10. Published 2018-02-15.
- How severe is CVE-2017-12725?
- Medium severity. CVSS v3 base score is 5.6 out of 10.