« Volver al listado

CVE-2020-12020

Estado: ModificadaMedia (6.1)—

Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Baxter — Em1200 FirmwareBaxter — Em2400 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-12020",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Baxter ExactaMix EM 2400 & EM 1200",
          "versions": [
            {
              "status": "affected",
              "version": "ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-29T14:15:11.210",
  "references": [
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsma-20-170-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user."
    },
    {
      "lang": "es",
      "value": "Baxter ExactaMix EM 2400 Versiones 1.10, 1.11 y 1.13 y ExactaMix EM1200 Versiones 1.1, 1.2 y 1.4, no restringe que los usuarios no administrativos consigan acceso al sistema operativo y editen el script de inicio de la aplicación. Una explotación con éxito de esta vulnerabilidad puede permitir a un atacante alterar el script de inicio como el usuario de acceso limitado"
    }
  ],
  "lastModified": "2026-06-17T02:51:16.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:baxter:em2400_firmware:1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11DFA9E3-77C8-4978-809C-D5B2EB5B7F7E"
            },
            {
              "criteria": "cpe:2.3:o:baxter:em2400_firmware:1.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01A12E3A-C493-4696-8031-7A6C1A0FDEF4"
            },
            {
              "criteria": "cpe:2.3:o:baxter:em2400_firmware:1.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA3A0CC5-8628-43AB-859D-0EDD439D2C11"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:baxter:em2400:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "244BA6D0-A33D-419C-B532-E62C9AE45F9E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:baxter:em1200_firmware:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA9FF60A-7CED-4FA3-8247-4EF8FD8BAFD4"
            },
            {
              "criteria": "cpe:2.3:o:baxter:em1200_firmware:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AC04969-E684-4D21-B889-A76DC4B54017"
            },
            {
              "criteria": "cpe:2.3:o:baxter:em1200_firmware:1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D218ACE-6C3F-4731-AF7B-2290D2A1AE09"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:baxter:em1200:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9AE1B01A-DA95-477B-95F6-43F8FD7827FF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}