Vulnerability in Baxter Welch Allyn Connex Spot Monitor
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52.
Vulnerability in Baxter Welch Allyn Connex Spot Monitor
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52.
Baxter has released a software update for all impacted devices and software to address this vulnerability. A new version of the product that mitigates the vulnerability is available as follows:
* Welch Allyn Connex Spot Monitor: Version 1.52.01 (available October 16, 2023)
Baxter recommends users upgrade to the latest versions of their products. Information on how to update products to their new versions can be found on the Baxter disclosure page https://www.baxter.com/product-security or the Hillrom disclosure page https://www.hillrom.com/en/responsible-disclosures/ .
Baxter recommends the following workarounds to help reduce risk:
* Apply proper network and physical security controls.
* Ensure a unique encryption key is configured and applied to the product (as described in the Connex Spot Monitor Service Manual).
Configurations
Workarounds
Exploits
Credits
reporter
Maarten Boone and Edwin Van Andel (CTO of Zerocopter) reported this vulnerability to Baxter.
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52.