CVE-2020-12024

Published Jun 29, 2020

Last updated 3 months ago

Overview

Description
Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to the system the ability to load an unauthorized payload or unauthorized access to the hard drive by booting a live USB OS. This could impact confidentiality and integrity of the system and risk exposure of sensitive information including PHI.
Source
ics-cert@hq.dhs.gov
NVD status
Modified

Risk scores

CVSS 3.1

Type
Primary
Base score
6.1
Impact score
5.2
Exploitability score
0.9
Vector string
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
3.6
Impact score
4.9
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:P/I:P/A:N

Weaknesses

ics-cert@hq.dhs.gov
CWE-284
nvd@nist.gov
NVD-CWE-Other

Social media

Hype score
Not currently trending

Configurations