What’s Vulnerable › Vulnerabilities

CVE-2022-26394: Unauthenticated network reconfiguration via TCP/UDP

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-09 · updated 2026-06-17
• Weakness: CWE-306

Description

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail.

Affected products

• Baxter Spectrum Iq 35700Bax3 Firmware: all versions
• Baxter Sigma Spectrum 35700Bax2 Firmware: all versions
• Baxter Sigma Spectrum 35700Bax Firmware: all versions
• Baxter Spectrum Wireless Battery Module Firmware: from 20d29 through 20d32; 16, 16d38, 17, 17d19

References

• https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx
• https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01
• https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

Get alerted when CVE-2022-26394 or the next vulnerability affects your stack