Medium severity · published Feb 15, 2018
CVE-2017-12722
An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
5.3
CVSS
2.4%
EPSS
No
On KEV
Description
An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump reads memory out of bounds, causing the communications module to crash. Smiths Medical assesses that the crash of the communications module would not impact the operation of the therapeutic module.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump ·
Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump · source: vendor
M4
Medfusion 4000 Wireless Syringe Infusion Pump · Smiths-medical
1.1; 1.5; 1.6 · source: NVD
Affected product
SM
Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12722
Third Party Advisory
http://www.securityfocus.com/bid/100665
Third Party Advisory
http://www.securityfocus.com/bid/101252
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A
More from Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
8.1
CVE-2017-12724
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
8.1
CVE-2017-12720
An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
8.1
CVE-2017-12718
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
7.3
CVE-2017-12726
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6
5.9
CVE-2017-12721
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6