Baxter Prismax Firmware vulnerabilities

3 CVEs affecting Baxter Prismax Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-12037, published 2020-06-29.

More from Baxter.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-12036, published 2020-06-29. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when configured to send treatment data to a PDMS…
• CVE-2020-12037, published 2020-06-29. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when configured to send treatment data to a PDMS…
• CVE-2020-12035, published 2020-06-29. Medium severity, CVSS 4.9. EPSS: 0.2% chance of exploitation in the next 30 days. Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provides access to biomedical information, device settings,…