CVE-2022-26392 describes a format string vulnerability in the Baxter Spectrum Wireless Battery Module (WBM) when operating in superuser mode, affecting versions v16, v16D38, v17, v17D19, and v20D29 to v20D32. This flaw allows an authenticated attacker to read sensitive memory via application messaging. Rated 6.5 MEDIUM on the CVSS scale, it has a low attack complexity and requires low privileges, posing a high confidentiality impact. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has received limited community discussion and media coverage, including an article from SecurityWeek.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 20d29, <= 20d32CPE matchmatch criteria | cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:*:*:*:*:*:*:*:* | ||
16CPE matchmatch criteria | cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16:*:*:*:*:*:*:* | ||
16d38CPE matchmatch criteria | cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:16d38:*:*:*:*:*:*:* | ||
17CPE matchmatch criteria | cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17:*:*:*:*:*:*:* | ||
17d19CPE matchmatch criteria | cpe:2.3:o:baxter:spectrum_wireless_battery_module_firmware:17d19:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.