CVE-2022-26392

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
Baxter	Baxter Spectrum Wireless Battery Module (WBM)	16; 16D38; 17; 17D19; 20D29; 20D30; 20D31; 20D32

References

https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxBroken Link
https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxBroken Link

Timeline

Published: Sep 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-263938.1The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the CVE-2022-263945.4The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in CVE-2022-26407.5The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse eng CVE-2022-26419.8Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform u CVE-2022-264138.0A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated CVE-2022-264145.5A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, w CVE-2022-264159.1On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-264177.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, wh CVE-2022-264197.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific proje CVE-2022-26427.5Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and CVE-2022-264208.8An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially CVE-2022-264217.3Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to