TI-2022-09764 Aliases CVE-2022-26394 GHSA-cf6p-6fqm-mpw5

Unauthenticated network reconfiguration via TCP/UDP

LOW 25CWE-306Published 2022-09-09 · Updated 2024-09-16

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail.

Why it matters now

EPSS 0.00352 29th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Baxter	Baxter Spectrum Wireless Battery Module (WBM)	16; 16D38; 17; 17D19; 20D29; 20D30; 20D31; 20D32	—	No fix listed	CNA

Baxter Spectrum Wireless Battery Module (WBM) VendorBaxter Affected 16; 16D38; 17; 17D19; 20D29; 20D30; 20D31; 20D32 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware::::::::	20d29 – 20d32	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16:::::::*	16	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16d38:::::::*	16d38	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17:::::::*	17	Vulnerable	Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17d19:::::::*	17d19	Vulnerable	Baxter
cpe:2.3:h:baxter:spectrum_wireless_battery_module:-:::::::*	not specified by NVD	Running on	Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax_firmware:-:::::::*	not specified by NVD	Vulnerable	Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax:-:::::::*	not specified by NVD	Running on	Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax2_firmware:-:::::::*	not specified by NVD	Vulnerable	Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax2:-:::::::*	not specified by NVD	Running on	Baxter

cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:*:*:*:*:*:*:*:* Versions 20d29 – 20d32 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16:*:*:*:*:*:*:* Versions 16 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16d38:*:*:*:*:*:*:* Versions 16d38 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17:*:*:*:*:*:*:* Versions 17 Vulnerable ·Baxter
cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17d19:*:*:*:*:*:*:* Versions 17d19 Vulnerable ·Baxter
cpe:2.3:h:baxter:spectrum_wireless_battery_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter
cpe:2.3:o:baxter:sigma_spectrum_35700bax2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Baxter
cpe:2.3:h:baxter:sigma_spectrum_35700bax2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:baxter:baxter_spectrum_iq_35700bax3_firmware:-:::::::*	not specified by NVD	Vulnerable	Baxter
cpe:2.3:h:baxter:baxter_spectrum_iq_35700bax3:-:::::::*	not specified by NVD	Running on	Baxter

cpe:2.3:o:baxter:baxter_spectrum_iq_35700bax3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Baxter
cpe:2.3:h:baxter:baxter_spectrum_iq_35700bax3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Baxter

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-26394
2026-10-03 Alias added: GHSA-cf6p-6fqm-mpw5

References

Advisory 1

https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01

Other 1

https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

TI-2022-09763 Format String vulnerability CVSS 3.1HIGH 8.1
TI-2022-09762 Format String vulnerability CVSS 3.1MEDIUM 6.5
TI-2022-09761 Unencrypted internal storage of security credentials CVSS 3.1MEDIUM 4.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences