Baxter in MedDevice Cyber coverage: 30 stories, 38 products named, 41 CVEs, and the company's own disclosures.
ShinyHunters listed Baxter International on its extortion site on August 14, claiming more than 7.1 million Salesforce records, one day after Baxter disclosed unauthorized activity involving third-party applications. Baxter says manufacturing, patient services, and its products are unaffected and has not confirmed any data theft.
Baxter's Starling-2026-001 bulletin, published in June 2026, says a security assessment of the Starling Fluid Management Monitoring System found potential vulnerabilities, including the unsupported Windows Embedded Compact 7 operating system.
A Baxter bulletin flagged that Abacus supports encrypted client-server communication but did not enable transport encryption by default in legacy configurations, leaving SQL traffic open to interception.
Baxter bulletin Abacus-2026-001 says ABACUS Software lets the client to SQL server link run without encryption, which is not enabled by default in versions 3.3.5 and prior.
Baxter bulletin DoseEdge-2026-001 says the DoseEdge Pharmacy Workflow Manager local server, all versions, allows HTTP instead of HTTPS to peripheral devices, which could expose compounding order data in plaintext.
Baxter bulletin 80031885 Rev. A says a flaw in how Connex CVSM, CIWS and CSM devices with the Newmar radio handle PIM files could expose network information, reconfigure the radio and cut clinical data connectivity; a fix is in development.
ICSMA-24-319-01: Baxter Life2000 Ventilation System carried nine CVEs, two rated a maximum 10.0, spanning hard-coded credentials, cleartext transmission, an exposed JTAG interface and missing authentication.
ICSMA-24-249-01: the Baxter Connex Health Portal had a critical unauthenticated SQL injection, base score 10.0, letting a remote attacker run arbitrary SQL, plus an access-control flaw exposing patient and clinician data.
CISA advisory ICSMA-24-151-01 covers CVE-2024-5176 (CWE-522, CVSS 9.6) in the Baxter Welch Allyn Product Configuration Tool 1.9.4.1 and prior: any credentials used in the tool may be compromised. Baxter pulled the tool and planned 1.9.4.2 for Q3 2024.
CISA advisory ICSMA-24-151-02 covers CVE-2024-1275 (CWE-1394, CVSS 7.4), a default cryptographic key in the Baxter Welch Allyn Connex Spot Monitor 1.52 and prior that could allow changes to device configuration and firmware data. Version 1.52.01 fixes it.
Baxter said on February 26, 2024 that it found no indication its products are affected by CVE-2024-1709 and CVE-2024-1708 in ConnectWise ScreenConnect 23.9.7 and prior, and no privacy impact.
Baxter's January 31, 2024 bulletin lists Hillrom Smart Device Connectivity, Welch Allyn RetinaVue Network, ELI Link (HL7 configuration), Voalte Nurse Call and Sharesource Connect as possibly affected by critical Mirth Connect flaw CVE-2023-43208.
CISA advisory ICSMA-22-251-01 covers four flaws in Baxter Sigma Spectrum and Spectrum IQ infusion pump Wireless Battery Modules, including unencrypted stored network credentials and PHI (CVE-2022-26390) and missing mutual authentication with the gateway server (CVE-2022-26394, CVSS 7.5). Deral Heiland of Rapid 7 reported them.
CISA advisory ICSMA-22-167-01 covers CVE-2022-26388 (hard-coded password, CVSS v3 6.4) and CVE-2022-26389 (improper access control, CVSS v3 7.7) in Welch Allyn ELI 150c, 250c, 280 and 380 resting electrocardiographs. Hillrom has released software updates for all of them.
Baxter's March 22, 2022 bulletin states that all fielded versions of Amia and Kaguya use Axeda agents listed in PTC's Access:7 advisory, and that it is working with PTC to upgrade the agent during 2022.
Baxter's Log4j bulletin of December 13, 2021, updated December 28, 2021, says all Baxter products are either not impacted, patched, or mitigations have been applied for the critical Apache Log4j vulnerabilities.
CISA advisory ICSMA-21-343-01 covers CVE-2021-43935 (CWE-288, CVSS 8.1) in seven Hillrom Welch Allyn cardiology products, including Q-Stress, X-Scribe and R-Scribe, which accepted any provisioned Active Directory account without a password when SSO was configured.
Baxter's July 23, 2021 bulletin on CERT/CC VU#383432 says all ExactaMix 1200 and 2400 versions contain Windows and are impacted by CVE-2021-34527, the PrintNightmare Print Spooler remote code execution flaw.
CISA advisory ICSMA-21-152-01 covers an out-of-bounds write (CVE-2021-27410) and out-of-bounds read (CVE-2021-27408), both CVSS 5.9, across Hillrom Welch Allyn Connex monitors, Spot 4400, the Network Connectivity Engine, the SDK and service tools. Chained, they can lead to code execution. Fixed versions are listed per product.
Baxter says PrisMax software 2.1, when connected to an EMR/PDMS via Ethernet, uses GHnet v2, a modified Treck TCP/IP stack, and is affected by CVE-2020-11907, CVE-2020-11911 and CVE-2020-11914, with impact limited to network connectivity.
CISA advisory ICSMA-20-170-01 covers seven flaws in Baxter ExactaMix EM1200 and EM2400 compounders, led by hard-coded OS admin credentials (CVE-2020-12016, CVSS 8.1), cleartext order traffic and an unencrypted database. Baxter recommends upgrading to EM1200 1.4 and EM2400 1.13 plus compensating controls.
CISA advisory ICSMA-20-170-03 covers CVE-2020-12048 (CWE-319, CVSS v3 7.5) in the Baxter Phoenix Hemodialysis Delivery System versions 3.36 and 3.40, which does not encrypt data sent to the Exalis data management tool. Baxter issued implementation guidance.
CISA advisory ICSMA-20-170-02 covers missing authentication (CVE-2020-12035, CVSS v3 7.6), cleartext transmission (CVE-2020-12036, CVSS v3 6.5) and a hard-coded service password (CVE-2020-12037) in Baxter PrismaFlex and PrisMax. PrisMax v3 with the Digital Communication Module adds a mutually authenticated TLS tunnel.
CISA advisory ICSMA-20-170-04 (Update B) covers six flaws in Baxter Sigma Spectrum and Spectrum infusion systems and their Wireless Battery Modules, including a hard-coded Telnet login (CVE-2020-12045, CVSS 8.6) and cleartext pump communications (CVE-2020-12040). Baxter lists network and physical controls.
Baxter says all versions of the Spectrum Wireless Battery Module use the Treck TCP/IP stack in Digi Net+OS and contain the Ripple20 vulnerabilities, CVE-2020-11896 to CVE-2020-11914; an October 2024 update adds the latest Digi patch for CVE-2020-11901.
Baxter evaluated its products against CISA alert AA20-014A and found ExactaMix v1.4/v1.5 (EM1200) and v1.13/v1.14 (EM2400) susceptible to CVE-2020-0611, a Remote Desktop Client remote code execution vulnerability.
Baxter's March 9, 2020 bulletin says no Baxter products use an impacted version of Bluetooth for the SweynTooth BLE vulnerabilities covered in CISA's ICS-ALERT-20-063-01.
Baxter says ExactaMix EM1200 v1.1 and v1.2 and EM2400 v1.10 and v1.11 run Windows builds affected by the MS17-010 SMBv1 remote code execution vulnerabilities. ExactaMix v1.4 (EM1200) and v1.13 (EM2400) move to Windows 10 with SMBv1 disabled.
Baxter's September 24, 2019 bulletin on Urgent/11 (CVE-2019-12255 through CVE-2019-12265) says no Baxter products use the Interpeak IPnet TCP/IP stack or an impacted version of an RTOS.
Baxter's May 16, 2019 bulletin lists ExactaMix (EM2400) v1.10/v1.11 and ExactaMix (EM1200) v1.1/1.2 as running an operating system susceptible to CVE-2019-0708 and recommends upgrading to EM1200 v1.4 and EM2400 v1.13 on Windows 10.
Baxter products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.
| Product | Device type | Attributes | Matched advisories |
|---|---|---|---|
| WAVE Clinical Platform | Monitor, Physiological, Patient (Without Arrhythmia Detection Or Alarms) | 24 | 32 |
| Dose IQ Safety Software | Infusion Safety Management Software | 23 | 31 |
| Novum IQ Large Volume Pump | Pump, Infusion | 18 | 12 |
| Welch Allyn Connex Spot Monitor; 901058 Vital Signs Monitor Core | Monitor, Physiological, Patient (Without Arrhythmia Detection Or Alarms) | 20 | 8 |
| Homechoice Claria APD System | System, Peritoneal, Automatic Delivery | 12 | 7 |
| Spectrum IQ Infusion System with Dose IQ Safety Software | Pump, Infusion | 24 | 3 |
| Baxter SIGMA Spectrum Infusion Pump with Master Drug Library | Pump, Infusion | 8 | 1 |
| Hillrom Heart and Respiration Rate Monitoring System powered by | Monitor, Breathing Frequency | 20 | 1 |
| iExaminer System with Panoptic Plus | Camera, Ophthalmic, Ac-Powered | 2 | 0 |
| Intravascular Administration Sets | Set, Administration, Intravascular | 4 | 0 |
| Intravascular Extension Set | Set, Administration, Intravascular | 3 | 0 |
| Maximus System | Device, Positive Pressure Breathing, Intermittent | 7 | 0 |
| Novum IQ Syringe Pump | Pump, Infusion | 20 | 0 |
| SIGMA Spectrum Infusion Pump with Master Drug Library | Pump, Infusion | 7 | 0 |
| The Vest APX System | Percussor, Powered-Electric | 10 | 0 |