CVE-2020-12032CWE-311

Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted…

published June 29, 2020

CVSS
—
EPSS
1%
Percentile
60.8
In the wild
Unconfirmed
What it is

⚠️ Sensitive data is on display! The Baxter ExactaMix EM 2400 and EM 1200 systems let attackers with network access peek right into an unencrypted database, where sensitive info is hanging out like it’s no big deal. 😬 Think of it like leaving your medical records on a cafe table — anyone walking by can just grab them! This flaw allows attackers to access private health information without breaking a sweat. An attacker could easily view or even modify sensitive patient health information (PHI), potentially leading to catastrophic privacy violations. Imagine the chaos that could ensue if someone alters prescription details or patient records without a trace!

Put simply

Think of it like leaving your medical records on a cafe table — anyone walking by can just grab them! This flaw allows attackers to access private health information without breaking a sweat. The vulnerability in Baxter ExactaMix systems arises from the lack of encryption for sensitive data stored in the database, making it accessible to anyone with network access.

What to do

An attacker could easily view or even modify sensitive patient health information (PHI), potentially leading to catastrophic privacy violations. Imagine the chaos that could ensue if someone alters prescription details or patient records without a trace! To protect sensitive information, patch the systems to the latest versions recommended by Baxter. Additionally, encrypt the database to safeguard data at rest and review network security configurations to limit unauthorized access. You can tackle this! Implement these fixes and safeguard your data like the security hero you are! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00949 · 60.8th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2020-06-29T13:53Z
EPSS history
Timeline
  • 29 JUN 13:53Z
    Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted…
    cvelistv5