#VU67148 Format string error in Baxter products - CVE-2022-26392

Vulnerability identifier: #VU67148

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-26392

CWE-ID: CWE-134

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Sigma Spectrum model 35700BAX
Sigma Spectrum model 35700BAX2
Baxter Spectrum IQ model 35700BAX3
Baxter Spectrum IQ LVP with Wireless Battery Modules
Sigma Spectrum LVP Wireless Battery Modules

Software vendor:
Baxter

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a format string error within the application messaging when in superuser mode. A remote user can read memory in the WBM and access sensitive information.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://ics-cert.us-cert.gov/advisories/icsma-22-251-01
• https://www.baxter.com/sites/g/files/ebysai3896/files/2022-09/ICSMA-22-251-01.pdf