CVE-2020-12036: High severity prisma vulnerability
Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when configured to send treatment data to a PDMS (Patient Data Management System) or an EMR (Electronic Medical Record) system. An attacker could observe sensitive data sent from the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12036?
CVE-2020-12036 is considered a high-severity vulnerability due to the lack of data-in-transit encryption.
How do I fix CVE-2020-12036?
To mitigate CVE-2020-12036, ensure that all devices are updated to the latest firmware version with implemented data encryption.
Which systems are affected by CVE-2020-12036?
CVE-2020-12036 affects all versions of Baxter PrismaFlex and PrisMax prior to version 3.x.
What type of data is vulnerable in CVE-2020-12036?
CVE-2020-12036 exposes treatment data transmitted to PDMS or EMR systems that are not encrypted.
Can an attacker exploit CVE-2020-12036 remotely?
Yes, an attacker could potentially exploit CVE-2020-12036 remotely by intercepting unencrypted treatment data during transmission.