CVE-2017-12725

CVE-2017-12725 describes a hard-coded credentials vulnerability in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pumps (versions 1.1, 1.5, and 1.6). This flaw allows the pump to automatically establish a wireless network connection using default, unchangeable credentials. The vulnerability carries a CVSS score of 5.6 (Medium), indicating a network-based attack with high attack complexity and low impacts on confidentiality, integrity, and availability. While the pump prioritizes wired connections when available, the persistent wireless association presents a potential attack surface. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting limited public awareness or active threat.