title: Unencrypted internal storage of security credentials
description: The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
problem types: CWE-311 Missing Encryption of Sensitive Data
affected:
{
product: Baxter Spectrum Wireless Battery Module (WBM)
vendor: Baxter
versions:
status: affected, version: 16
status: affected, version: 16D38
status: affected, version: 17
status: affected, version: 17D19
status: affected, version: 20D29
status: affected, version: 20D30
status: affected, version: 20D31
status: affected, version: 20D32
status: affected, version: 22D19
status: affected, version: 22D20
status: affected, version: 22D21
status: affected, version: 22D22
status: affected, version: 22D23
status: affected, version: 22D24
status: affected, version: 22D25
status: affected, version: 22D26
status: affected, version: 22D27
status: affected, version: 22D28
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]