{"id":"CVE-2024-1275","state":"PUBLISHED","title":"Vulnerability in Baxter Welch Allyn Connex Spot Monitor","description":"Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52.","publishedAt":"2024-05-31T17:23:19.207Z","updatedAt":"2024-08-01T18:33:25.355Z","severity":{"score":9.1,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"Baxter"},"assigner":"Baxter","products":["Baxter Welch Allyn Connex Spot Monitor"],"affected":[{"vendor":"Baxter","product":"Welch Allyn Connex Spot Monitor","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.52","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-151-02"],"weaknesses":["CWE-1394"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1275.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1275","state":"PUBLISHED","datePublished":"2024-05-31T17:23:19.207Z","dateUpdated":"2024-08-01T18:33:25.355Z","assignerShortName":"Baxter","assignerOrgId":"dba971b9-eb30-4121-91e1-3b45611354aa","dateReserved":"2024-02-06T14:20:33.446Z"},"containers":{"cna":{"title":"Vulnerability in Baxter Welch Allyn Connex Spot Monitor","descriptions":[{"lang":"en","value":"Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52."}],"affected":[{"vendor":"Baxter","product":"Welch Allyn Connex Spot Monitor","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.52","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-151-02"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.1,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1394","description":"CWE-1394 Use of Default Cryptographic Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Baxter","orgId":"dba971b9-eb30-4121-91e1-3b45611354aa","dateUpdated":"2024-06-05T14:42:55.386Z"},"credits":[{"lang":"en","type":"reporter","value":"Maarten Boone and Edwin Van Andel (CTO of Zerocopter) reported this vulnerability to Baxter."}],"datePublic":"2024-05-30T17:00:00.000Z","impacts":[{"capecId":"CAPEC-176","descriptions":[{"lang":"en","value":"CAPEC-176 Configuration/Environment Manipulation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Baxter has released a software update for all impacted devices and software to address this vulnerability. A new version of the product that mitigates the vulnerability is available as follows:

Baxter recommends users upgrade to the latest versions of their products. Information on how to update products to their new versions can be found on the Baxter disclosure page or the Hillrom disclosure page.

Baxter recommends the following workarounds to help reduce risk:

"}],"value":"Baxter has released a software update for all impacted devices and software to address this vulnerability. A new version of the product that mitigates the vulnerability is available as follows:\n\n * Welch Allyn Connex Spot Monitor: Version 1.52.01 (available October 16, 2023)\n\n\nBaxter recommends users upgrade to the latest versions of their products. Information on how to update products to their new versions can be found on the Baxter disclosure page https://www.baxter.com/product-security  or the Hillrom disclosure page https://www.hillrom.com/en/responsible-disclosures/ .\n\nBaxter recommends the following workarounds to help reduce risk:\n\n * Apply proper network and physical security controls.\n * Ensure a unique encryption key is configured and applied to the product (as described in the Connex Spot Monitor Service Manual)."}],"source":{"advisory":"ICSMA-24-151-02","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"baxter","product":"welch_allyn_connex_spot_monitor","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.52","versionType":"custom"}],"cpes":["cpe:2.3:o:baxter:welch_allyn_connex_spot_monitor:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-05T14:39:19.332683Z","id":"CVE-2024-1275","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-05T15:01:00.230Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-151-02","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:33:25.355Z"}}]}}}