CVE-2020-12020

Published Jun 29, 2020

Last updated 4 years ago

Overview

Description
Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user.
Source
ics-cert@hq.dhs.gov
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
6.1
Impact score
4.2
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
3.6
Impact score
4.9
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:N/I:P/A:P

Weaknesses

nvd@nist.gov
CWE-668
ics-cert@hq.dhs.gov
CWE-668

Social media

Hype score
Not currently trending

Configurations