CVE-2022-26394

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Baxter	Baxter Spectrum Wireless Battery Module (WBM)	16; 16D38; 17; 17D19; 20D29; 20D30; 20D31; 20D32

References

https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxBroken Link
https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xxBroken Link

Timeline

Published: Sep 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-26407.5The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse eng CVE-2022-26419.8Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform u CVE-2022-264138.0A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated CVE-2022-264145.5A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, w CVE-2022-264159.1On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-264177.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, wh CVE-2022-264197.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific proje CVE-2022-26427.5Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and CVE-2022-264208.8An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially CVE-2022-264217.3Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to CVE-2022-264237.5Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-264257.3Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI