Vulnerability

Baxter Sigma Spectrum wireless battery modules keep Wi-Fi credentials unencrypted and skip server authentication

MedDevice Cyber Staff · Sep 8 · 4 min read · Via CISA ICSMA-22-251-01

CISA published advisory ICSMA-22-251-01 on September 8, 2022, for Baxter Sigma Spectrum 6.x (model 35700BAX) and 8.x (35700BAX2) infusion pumps and Spectrum IQ 9.x (35700BAX3), all through their Wireless Battery Modules (WBM). Deral Heiland of Rapid 7 reported four vulnerabilities.

CVE-2022-26390 (CWE-311, CVSS v3 4.2): the WBM stores network credentials and PHI unencrypted. PHI is only stored in Spectrum IQ pumps using auto programming. Anyone with physical access to a pump or WBM that was not wiped may be able to extract it.

CVE-2022-26394 (CWE-306, CVSS 7.5) is the highest score. The WBM does not perform mutual authentication with the gateway server host, so an attacker can sit in the middle, modify parameters to break the connection, or spoof the server and send crafted data. CVE-2022-26392 (CVSS 3.1) and CVE-2022-26393 (CVSS 5.0) are format string flaws in application messaging that can read WBM memory, and the second can also cause a denial of service.

The physical access case is the one hospitals create themselves. Pumps and battery modules get decommissioned, resold or moved between facilities, and each one can carry the hospital's Wi-Fi credentials out the door.

Baxter says WBM version 20D30 fixes CVE-2022-26393, Spectrum IQ already provides authentication for CVE-2022-26394, software updates to disable Telnet and FTP are in process, and erase instructions are being added to the Spectrum Operator's Manual. It also recommends physical controls, a dedicated VLAN for the infusion system, and the strongest available wireless security such as WPA2 and EAP-TLS.

Treat a pump leaving the building like a laptop leaving the building: wipe it before it goes.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Erase every Sigma Spectrum pump and Wireless Battery Module before decommissioning or transfer: reset network settings, delete the drug library and clear the history log. Move WBMs to version 20D30 or later for the format string flaw, isolate the infusion system on its own VLAN, and use WPA2 with EAP-TLS. Baxter's Telnet and FTP updates are still in process.

Wipe before decommissioning. Reset network settings, delete the drug library and clear the history log on pumps; reset WBMs using Baxter's procedure.
Update the WBM. Run WBM version 20D30 or later, which addresses CVE-2022-26393.
Isolate the infusion network. Place the Spectrum Infusion System on its own VLAN with WPA2 and EAP-TLS.
Authenticate the gateway. Require mutual authentication between the battery module and its server, and encrypt stored credentials.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Handles patient data Hospital network

Spectrum Wireless Battery Module

PID-4111 Wireless connectivity

Sigma Spectrum

Wireless connectivity

Spectrum IQ

Handles patient data Wireless connectivity

Fix the class in your product

Passwords are reversible or one key is shared across every install. As the maker, hash credentials with a purpose-built password algorithm, derive keys uniquely per installation, and bind tokens so a captured one cannot be replayed.

Hash, do not encode. Store credentials with a salted, memory-hard algorithm (argon2id or scrypt).
Derive keys per install. Never compile a shared key into the image; back it with a secure element.
Bind tokens against replay. Tie tokens to expiry, a nonce, and session context.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2022-26390 in the Baxter Sigma Spectrum infusion pump?

CVE-2022-26390 (CWE-311, CVSS v3 4.2) means the Baxter Spectrum Wireless Battery Module stores network credentials and PHI unencrypted. An attacker with physical access to a pump or WBM that was not erased may extract them, per CISA advisory ICSMA-22-251-01 from September 8, 2022.

How do I erase a Baxter Spectrum pump before decommissioning?

Baxter's steps in CISA advisory ICSMA-22-251-01: reset the network settings (Biomed, Network Configuration, Transfer Network Settings, Reset), delete the drug library and clear the history log. For the Wireless Battery Module, place it on a different pump with reset network settings and networking enabled, then wait until the network icon turns yellow.

Who found the Baxter Sigma Spectrum vulnerabilities?

Deral Heiland of Rapid 7 reported CVE-2022-26390, CVE-2022-26392, CVE-2022-26393 and CVE-2022-26394 in Baxter Sigma Spectrum and Spectrum IQ Wireless Battery Modules, published in CISA advisory ICSMA-22-251-01 on September 8, 2022.

← Back to Vulnerabilities