Skip to content
Fencer Vulns
medium 4.2

CVE-2022-26390 json

Unencrypted internal storage of security credentials

published 2022-09-09 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30949

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-22-251-01 updated cvss 4.2

Baxter Sigma Spectrum Infusion Pump (Update A)

  • Baxter Spectrum IQ 9.x model 35700BAX3 Baxter Spectrum IQ LVP 9.x (with Wireless Battery Modules >= 22D19, <= v22D28) Baxter Sigma Spectrum 8.x model 35700BAX2, 6.x model 35700BAX Baxter Sigma Spectrum LVP 8.x (Wireless Battery Modules v17, v17D19 >= 20D29, <= 20D32, >= 22D24, <= 22D28), 6.x (Wireless Battery Modules (16, 16D38, 17, 17D19, >= 20D29, <= v20D32, >= 22D24, <= v22D28)
    affected: vendor fix, mitigation “Ensure appropriate physical controls within user environments to protect against unauthorized access to devices.” baxter.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Baxter Baxter Spectrum Wireless Battery Module (WBM)

Classification

Weakness
  • CWE-311 Missing Encryption of Sensitive Data
  • CWE-312 Cleartext Storage of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.