Sign-up

ID

VAR-202006-0333


CVE

CVE-2020-12048


TITLE

Phoenix Hemodialysis Delivery System SW Vulnerability in plaintext transmission of important information in

Trust: 0.8

sources: JVNDB: JVNDB-2020-007828

DESCRIPTION

Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool

Trust: 2.16

sources: NVD: CVE-2020-12048 // JVNDB: JVNDB-2020-007828 // CNVD: CNVD-2021-21082

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-21082

AFFECTED PRODUCTS

vendor:baxtermodel:phoenix x36scope:eqversion:3.36

Trust: 1.8

vendor:baxtermodel:phoenix x36scope:eqversion:3.40

Trust: 1.8

vendor:baxtermodel:phoenix hemodialysis delivery system swscope:eqversion:3.36

Trust: 0.6

vendor:baxtermodel:phoenix hemodialysis delivery system swscope:eqversion:3.40

Trust: 0.6

sources: CNVD: CNVD-2021-21082 // JVNDB: JVNDB-2020-007828 // NVD: CVE-2020-12048

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-12048
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-007828
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-21082
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202006-1238
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-12048
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-007828
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2021-21082
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-12048
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-007828
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-21082 // JVNDB: JVNDB-2020-007828 // CNNVD: CNNVD-202006-1238 // NVD: CVE-2020-12048

PROBLEMTYPE DATA

problemtype:CWE-319

Trust: 1.8

sources: JVNDB: JVNDB-2020-007828 // NVD: CVE-2020-12048

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-1238

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202006-1238

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-007828

PATCH
title:PHOENIX X36url:https://econnect.baxter.com/assets/downloads/products_expertise/renal_therapies/Phoenix_X36_Brochure_FINAL.pdf
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2020-007828

EXTERNAL IDS
db:NVDid:CVE-2020-12048
Trust: 3.0
db:ICS CERTid:ICSMA-20-170-03
Trust: 3.0
db:JVNid:JVNVU91499991
Trust: 0.8
db:JVNDBid:JVNDB-2020-007828
Trust: 0.8
db:CNVDid:CNVD-2021-21082
Trust: 0.6
db:NSFOCUSid:47297
Trust: 0.6
db:CNNVDid:CNNVD-202006-1238
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2021-21082 // 
            
            
            
            JVNDB: JVNDB-2020-007828 // 
            
            
            
            CNNVD: CNNVD-202006-1238 // 
            
            
            
            NVD: CVE-2020-12048

REFERENCES
url:https://www.us-cert.gov/ics/advisories/icsma-20-170-03
Trust: 3.0
url:https://nvd.nist.gov/vuln/detail/cve-2020-12048
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-12048
Trust: 0.8
url:https://jvn.jp/vu/jvnvu91499991/
Trust: 0.8
url:http://www.nsfocus.net/vulndb/47297
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2021-21082 // 
            
            
            
            JVNDB: JVNDB-2020-007828 // 
            
            
            
            CNNVD: CNNVD-202006-1238 // 
            
            
            
            NVD: CVE-2020-12048

CREDITS
Baxter
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202006-1238

SOURCES
db:CNVDid:CNVD-2021-21082
db:JVNDBid:JVNDB-2020-007828
db:CNNVDid:CNNVD-202006-1238
db:NVDid:CVE-2020-12048

LAST UPDATE DATE
2024-11-23T19:42:06.603000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2021-21082date:2021-03-23T00:00:00
db:JVNDBid:JVNDB-2020-007828date:2020-08-27T00:00:00
db:CNNVDid:CNNVD-202006-1238date:2020-07-29T00:00:00
db:NVDid:CVE-2020-12048date:2024-11-21T04:59:10.710

SOURCES RELEASE DATE
db:CNVDid:CNVD-2021-21082date:2021-03-23T00:00:00
db:JVNDBid:JVNDB-2020-007828date:2020-08-27T00:00:00
db:CNNVDid:CNNVD-202006-1238date:2020-06-18T00:00:00
db:NVDid:CVE-2020-12048date:2020-06-29T14:15:11.990