Vulnerability

Baxter Sigma Spectrum infusion pumps and wireless battery modules carry hard-coded passwords

MedDevice Cyber Staff · Jun 18 · 4 min read · Via CISA ICSMA-20-170-04

CISA published advisory ICSMA-20-170-04 on June 18, 2020, later revised as Update B, covering six vulnerabilities in Baxter infusion systems: the Sigma Spectrum v6.x (model 35700BAX), Baxter Spectrum v8.x (model 35700BAX2) and v9.x (model 35700BAX3), and the Spectrum Wireless Battery Module (WBM) across firmware from v9 through v22D28. Baxter Healthcare reported them.

On the pump, CVE-2020-12039 (CWE-259, CVSS v3 4.3) is a set of hard-coded passwords that, typed on the keypad, open the biomedical menus: device settings, calibration values and WBM network configuration. CVE-2020-12040 (CWE-319, CVSS 7.3) is an unauthenticated cleartext channel at the application layer for system status and operational data, open to anyone past network defenses for viewing or man-in-the-middle.

The WBM carries the rest. CVE-2020-12045 (CVSS 8.6) is a Telnet service with hard-coded credentials when the module is connected to specific SSIDs. CVE-2020-12041 (CWE-732, CVSS 8.6) means that Telnet interface exposes sensitive data and allows temporary network setting changes and reboots.

CVE-2020-12047 (CVSS 7.3) is an FTP service with hard-coded credentials in the factory-default wireless configuration of WBM v17 onward. CVE-2020-12043 (CWE-672, CVSS 7.3) keeps that FTP service running until the WBM is rebooted.

The advisory lists no fixed version. Baxter's guidance is operational: physical controls around pumps, a dedicated VLAN for the Spectrum system, WPA2 or EAP-TLS wireless security, blocking unexpected traffic such as FTP at the VLAN boundary, and rebooting each WBM after configuration by removing it from the pump for 10 to 15 seconds.

As a last resort, Baxter says the wireless function can be disabled, because the Spectrum was designed to run without network access. The cost is slower drug library updates.

Pulling a battery module for 15 seconds to kill an FTP server is a reasonable fix to put in the biomed checklist, and a strange one to need.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

No fixed version is listed for the Sigma Spectrum and Spectrum pumps or their Wireless Battery Modules. Put the pumps on a dedicated VLAN with WPA2 or EAP-TLS, block FTP and Telnet into it, reboot each WBM after network configuration, and control physical access to pump keypads. Disabling wireless is the last resort, at the cost of slower drug library updates.

Isolate the pumps on a VLAN. Give the Spectrum system its own segment and block unexpected traffic such as FTP at its boundary.
Reboot each WBM after setup. Remove the module from the pump for 10 to 15 seconds and reattach it to stop the FTP service.
Use strong wireless security. Configure WPA2 or EAP-TLS for pump wireless traffic.
Guard the keypad. Keep pumps where unauthorized people cannot enter the biomedical menu passwords.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Therapy delivery Wireless connectivity

Contributing

User accounts Hospital network

Sigma Spectrum Infusion System

PID-3321 PID-4112 Therapy delivery

Baxter Spectrum Infusion System

PID-3321 Therapy delivery

Spectrum Wireless Battery Module (WBM)

PID-3321 PID-41 Wireless connectivity User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
BD Alaris System with Guardrails Suite MX v12.1.2	BD	Same FDA device type	No feedback feed from manufacturer

Questions & Answers

What is CVE-2020-12045 in the Baxter Spectrum Wireless Battery Module?

CVE-2020-12045 (CWE-259, CVSS v3 8.6) is a Telnet service with hard-coded credentials in the Baxter Spectrum Wireless Battery Module (v9 through v22D28) when connected to specific SSIDs. CISA published it in ICSMA-20-170-04 on June 18, 2020.

Is there a patch for the Baxter Sigma Spectrum hard-coded password flaws?

CISA advisory ICSMA-20-170-04, first published June 18, 2020, lists no fixed version. Baxter recommends physical controls, a dedicated VLAN, WPA2 or EAP-TLS, blocking FTP at the VLAN boundary, rebooting the WBM after configuration, and as a last resort disabling wireless operation.

Why does Baxter say to reboot the Spectrum WBM after configuration?

Under CVE-2020-12043, the FTP service on Baxter Spectrum WBM v17 and later stays running until the module is rebooted. Baxter says to remove the WBM from the pump for 10 to 15 seconds and reattach it, per CISA advisory ICSMA-20-170-04.

← Back to Vulnerabilities

Key Facts

Product 1: Sigma Spectrum Infusion System v6.x (model 35700BAX) (Baxter)
Device Type: Infusion pump
Product 2: Baxter Spectrum Infusion System v8.x (model 35700BAX2), v9.x (model 35700BAX3) (Baxter)
Device Type: Infusion pump
Product 3: Spectrum Wireless Battery Module (WBM) v9, v11, v13, v14, v15, v16, v16D38, v17, v17D19, v20D29 to v20D32, v22D19 to v22D28 (Baxter)
Device Type: Infusion pump wireless module
Material: Telnet all versions
Components: Pump, Battery, Firmware, Wireless Module, User Interface, Local Service
Interfaces: WiFi, TCP
Dataflows: Pump to Network Viewer: system status and operational data over unauthenticated cleartext channel; Network to Pump: drug library updates
Assets: Pump hard-coded biomedical menu passwords (Credentials); WBM Telnet hard-coded credentials (Credentials); WBM FTP hard-coded credentials (Credentials); Pump calibration values (Calibration Data); Pump device settings (Software Configuration); WBM network configuration (Software Configuration); System status and operational data (Telemetry Data); Drug library updates (Software Update)
Advisory: ICSMA-20-170-04
CVEs: CVE-2020-12045, CVE-2020-12040
CVSS: 8.6
Severity: High
Disclosed: Jun 18, 2020
Source: CISA ICSMA-20-170-04

Sources

Baxter: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: Baxter