CVE-2020-12043
📋 TL;DR
This vulnerability in Baxter Spectrum WBM allows attackers to maintain persistent FTP access even after wireless networking is disabled, until the device is rebooted. It affects healthcare organizations using vulnerable versions of the Baxter Spectrum WBM configured for wireless networking.
💻 Affected Systems
- Baxter Spectrum WBM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive patient data, modify device configurations, or disrupt medical operations via unauthorized FTP access.
Likely Case
Unauthorized access to FTP service leading to data theft or configuration changes.
If Mitigated
Limited impact if wireless networking is disabled and devices are regularly rebooted.
🎯 Exploit Status
Exploitation requires network access to the FTP service, which remains active post-configuration change.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Baxter for specific patched versions; refer to ICSMA-20-170-04.
Vendor Advisory: https://www.us-cert.gov/ics/advisories/icsma-20-170-04
Restart Required: Yes
Instructions:
1. Contact Baxter for patches or updates. 2. Apply patches as per vendor instructions. 3. Reboot the WBM device after patching.
🔧 Temporary Workarounds
Disable Wireless Networking and Reboot
allTurn off wireless networking and reboot the WBM to stop the FTP service.
No specific commands; use device interface to disable wireless and reboot.
Network Segmentation
allIsolate WBM devices on segmented networks to limit FTP access.
Configure firewall rules to block FTP traffic (port 21) to/from WBM.
🧯 If You Can't Patch
- Disable wireless networking and schedule regular reboots of WBM devices.
- Implement strict network access controls and monitor for unauthorized FTP connections.
🔍 How to Verify
Check if Vulnerable:
Check if WBM is running affected versions and has wireless networking enabled; test FTP connectivity after disabling wireless without reboot.Check Version:
Use device interface or vendor tools to check WBM firmware version.Verify Fix Applied:
After patching or workaround, confirm FTP service is not accessible when wireless is disabled.📡 Detection & Monitoring
Log Indicators:
- Unexpected FTP login attempts or file transfers in device logs.
Network Indicators:
- FTP traffic (port 21) to/from WBM devices, especially after wireless is disabled.
SIEM Query:
Example: 'source_ip:WBM_IP AND destination_port:21' for FTP connections.