TI-2022-09761 Aliases CVE-2022-26390 GHSA-8rq7-p3vq-fh83

Unencrypted internal storage of security credentials

LOW 20CWE-311Published 2022-09-09 · Updated 2024-09-17

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-311.

Summary

The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

Why it matters now

EPSS 0.00475 41st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Baxter	Baxter Spectrum Wireless Battery Module (WBM)	16; 16D38; 17; 17D19; 20D29; 20D30; 20D31; 20D32; 22D19; 22D20; 22D21; 22D22; 22D23; 22D24; 22D25; 22D26; 22D27; 22D28	—	No fix listed	CNA

Baxter Spectrum Wireless Battery Module (WBM) VendorBaxter Affected 16; 16D38; 17; 17D19; 20D29; 20D30; 20D31; 20D32; 22D19; 22D20; 22D21; 22D22; 22D23; 22D24; 22D25; 22D26; 22D27; 22D28 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware::::::::	20d29 – 20d32; 22d19 – 22d28	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16:::::::*	16	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16d38:::::::*	16d38	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17:::::::*	17	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17d19:::::::*	17d19	Vulnerable	Baxter
cpe:2.3:h:baxter:spectrum_wireless_battery_module:-:::::::*	not specified by NVD	Running on	Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax_firmware:-:::::::*	not specified by NVD	Vulnerable	Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax:-:::::::*	not specified by NVD	Running on	Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax2_firmware:-:::::::*	not specified by NVD	Vulnerable	Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax2:-:::::::*	not specified by NVD	Running on	Baxter

cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:*:*:*:*:*:*:*:* Versions 20d29 – 20d32; 22d19 – 22d28 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16:*:*:*:*:*:*:* Versions 16 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16d38:*:*:*:*:*:*:* Versions 16d38 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17:*:*:*:*:*:*:* Versions 17 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17d19:*:*:*:*:*:*:* Versions 17d19 Vulnerable ·Baxter
cpe:2.3:h:baxter:spectrum_wireless_battery_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:baxter:baxter_spectrum_iq_35700bax3_firmware:-:::::::*	not specified by NVD	Vulnerable	Baxter
cpe:2.3:h:baxter:baxter_spectrum_iq_35700bax3:-:::::::*	not specified by NVD	Running on	Baxter

cpe:2.3:o:baxter:baxter_spectrum_iq_35700bax3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Baxter
cpe:2.3:h:baxter:baxter_spectrum_iq_35700bax3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-26390
2026-10-03 Alias added: GHSA-8rq7-p3vq-fh83

References

Advisory 2

TI-2022-09763 Format String vulnerability CVSS 3.1HIGH 8.1
TI-2022-09762 Format String vulnerability CVSS 3.1MEDIUM 6.5
TI-2022-09764 Unauthenticated network reconfiguration via TCP/UDP CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences