https://vulnogram.org/ Most recent CVEs assigned by Baxter Healthcare (baxter). https://vulnogram.org/seaview/icons/baxter.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2022-26389 https://vulnogram.org/CVE-2022-26389 An improper access control vulnerability may allow privilege escalation.This issue affects: * ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prior; * ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph: Versions 2.3.1 and prior; * ELI 250c/BU… High Fri, 07 Feb 2025 17:07:27 GMT https://vulnogram.org/CVE-2022-26388 https://vulnogram.org/CVE-2022-26388 A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph: Versions 2.3.1 and prior; ELI 250c/BUR 250… Medium Fri, 07 Feb 2025 17:06:30 GMT https://vulnogram.org/CVE-2024-48967 https://vulnogram.org/CVE-2024-48967 The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, m… Critical Network Exploitable Thu, 14 Nov 2024 21:40:44 GMT https://vulnogram.org/CVE-2024-48966 https://vulnogram.org/CVE-2024-48966 The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or m… Critical Network Exploitable Thu, 14 Nov 2024 21:38:11 GMT https://vulnogram.org/CVE-2024-48970 https://vulnogram.org/CVE-2024-48970 The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause un… Critical Thu, 14 Nov 2024 21:31:14 GMT https://vulnogram.org/CVE-2024-48974 https://vulnogram.org/CVE-2024-48974 The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing… Critical Thu, 14 Nov 2024 21:27:10 GMT https://vulnogram.org/CVE-2024-48973 https://vulnogram.org/CVE-2024-48973 The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or h… Critical Thu, 14 Nov 2024 21:24:14 GMT https://vulnogram.org/CVE-2024-48971 https://vulnogram.org/CVE-2024-48971 The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinic… Critical Thu, 14 Nov 2024 21:13:36 GMT https://vulnogram.org/CVE-2024-9832 https://vulnogram.org/CVE-2024-9832 There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make change… Critical Thu, 14 Nov 2024 21:03:16 GMT https://vulnogram.org/CVE-2024-9834 https://vulnogram.org/CVE-2024-9834 Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. Critical Thu, 14 Nov 2024 20:57:22 GMT https://vulnogram.org/CVE-2024-6796 https://vulnogram.org/CVE-2024-6796 In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content. High Network Exploitable Mon, 09 Sep 2024 19:28:30 GMT https://vulnogram.org/CVE-2024-6795 https://vulnogram.org/CVE-2024-6795 In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. An attacker could have submitted a crafted payload… Critical Network Exploitable Mon, 09 Sep 2024 19:24:01 GMT https://vulnogram.org/CVE-2024-5176 https://vulnogram.org/CVE-2024-5176 Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior. Critical Network Exploitable Fri, 31 May 2024 17:26:05 GMT https://vulnogram.org/CVE-2024-1275 https://vulnogram.org/CVE-2024-1275 Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52. Critical Network Exploitable Fri, 31 May 2024 17:23:19 GMT https://vulnogram.org/CVE-2022-26393 https://vulnogram.org/CVE-2022-26393 The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM. Medium Fri, 09 Sep 2022 14:40:06 GMT https://vulnogram.org/CVE-2022-26390 https://vulnogram.org/CVE-2022-26390 The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings… Medium Fri, 09 Sep 2022 14:40:06 GMT https://vulnogram.org/CVE-2022-26392 https://vulnogram.org/CVE-2022-26392 The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sen… Low Fri, 09 Sep 2022 14:40:06 GMT https://vulnogram.org/CVE-2022-26394 https://vulnogram.org/CVE-2022-26394 The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail. Medium Fri, 09 Sep 2022 14:40:05 GMT