CVE Vulnerabilities

CVE-2017-12721

Improper Certificate Validation

Published: Feb 15, 2018 | Modified: Mar 02, 2018
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host certificates, leaving the pump vulnerable to a man-in-the-middle (MITM) attack.

Weakness

The product does not validate, or incorrectly validates, a certificate.

Affected Software

Name Vendor Start Version End Version
Medfusion_4000_wireless_syringe_infusion_pump Smiths-medical 1.1 1.1
Medfusion_4000_wireless_syringe_infusion_pump Smiths-medical 1.5 1.5
Medfusion_4000_wireless_syringe_infusion_pump Smiths-medical 1.6 1.6

Potential Mitigations

References