CVE-2017-12720 : An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000

An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.

Published 2018-02-15 10:29:00

Updated 2019-10-03 00:03:26

Source ICS-CERT

View at NVD, CVE.org

Products affected by CVE-2017-12720

Smiths-medical » Medfusion 4000 Wireless Syringe Infusion Pump » Version: 1.1
cpe:2.3:o:smiths-medical:medfusion_4000_wireless_syringe_infusion_pump:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Smiths-medical » Medfusion 4000 Wireless Syringe Infusion Pump » Version: N/A
Smiths-medical » Medfusion 4000 Wireless Syringe Infusion Pump » Version: 1.5
cpe:2.3:o:smiths-medical:medfusion_4000_wireless_syringe_infusion_pump:1.5:*:*:*:*:*:*:*
Matching versions
When used together with: Smiths-medical » Medfusion 4000 Wireless Syringe Infusion Pump » Version: N/A
Smiths-medical » Medfusion 4000 Wireless Syringe Infusion Pump » Version: 1.6
cpe:2.3:o:smiths-medical:medfusion_4000_wireless_syringe_infusion_pump:1.6:*:*:*:*:*:*:*
Matching versions
When used together with: Smiths-medical » Medfusion 4000 Wireless Syringe Infusion Pump » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-12720

EPSS FAQ

0.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 58 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-12720

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-12720

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-12720

https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A

Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Vulnerabilities (Update A) | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url
http://www.securityfocus.com/bid/100665

Medfusion 4000 Wireless Syringe Infusion Pump ICSMA-17-250-02 Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2017-12720

Products affected by CVE-2017-12720

Exploit prediction scoring system (EPSS) score for CVE-2017-12720

CVSS scores for CVE-2017-12720

CWE ids for CVE-2017-12720

References for CVE-2017-12720