Skip to content
Fencer Intel
critical 9.8

CVE-2020-12043 json

The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the…

published 6y ago modified 4mo ago also EUVD-2020-4359

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted.

Is CVE-2020-12043 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-20-170-04 updated cvss 7.3

Baxter Sigma Spectrum Infusion Pumps (Update B)

  • Baxter Spectrum v8.x model 35700BAX2, v9.x model 35700BAX3 Baxter Spectrum LVP v8.x (with Wireless Battery Modules v17, v17D19, >= v20D29, <= v20D32, >= v22D24, <= v22D28), v9.x (with Wireless Battery Module >= v22D19, <= v22D28) Baxter Sigma Spectrum v6.x model 35700BAX Baxter Sigma Spectrum LVP v6.x (with Wireless Battery Modules v9, v11, v13, v14, v15, v16, v16D38, v17, v17D19, >= v20D29, <=
    affected: vendor fix baxter.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.10% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • n/a Baxter Sigma Spectrum Infusion Pumps

Classification

Weakness
  • CWE-672 Operation on a Resource after Expiration or Release

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.