What is CVE-2020-12048?

CVE-2020-12048 is a high-severity vulnerability in Baxter Phoenix X36, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2020-06-29.

How severe is CVE-2020-12048?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Baxter Phoenix X36

CVE-2020-12048

Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool.

EPSS: 0.005 (37.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Baxter Phoenix_x36
Baxter Phoenix_x36_firmware — versions 3.36, 3.40
N/a Baxter Phoenix Hemodialysis Delivery System — versions Phoenix Hemodialysis Delivery System SW 3.36 and 3.40

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-12048?: CVE-2020-12048 is a high-severity vulnerability in Baxter Phoenix X36, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2020-06-29.
How severe is CVE-2020-12048?: High severity. CVSS v3 base score is 7.5 out of 10.