Skip to content
Fencer Vulns
low 3.1

CVE-2022-26392 json

Format String vulnerability

published 2022-09-09 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30951

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-22-251-01 updated cvss 3.1

Baxter Sigma Spectrum Infusion Pump (Update A)

  • Baxter Spectrum IQ 9.x model 35700BAX3 Baxter Spectrum IQ LVP 9.x (with Wireless Battery Modules >= 22D19, <= v22D28) Baxter Sigma Spectrum 8.x model 35700BAX2, 6.x model 35700BAX Baxter Sigma Spectrum LVP 8.x (Wireless Battery Modules v17, v17D19 >= 20D29, <= 20D32, >= 22D24, <= 22D28), 6.x (Wireless Battery Modules (16, 16D38, 17, 17D19, >= 20D29, <= v20D32, >= 22D24, <= v22D28)
    affected: vendor fix, mitigation “Ensure appropriate physical controls within user environments to protect against unauthorized access to devices.” baxter.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Baxter Baxter Spectrum Wireless Battery Module (WBM)

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.