No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
Credit: Baxter
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-5176 | CWE-522 Insufficiently Protected Credentials | 9.6 Critical |
Any credentials that were used for authentication or input while using the Welch Allyn Configuration Tool have the potential to be compromised and should be changed immediately. Mitigation: Baxter has found no evidence to date of any compromise of personal or health data. Baxter will release a software update for all impacted software to address this vulnerability. A new version of the product that mitigates the vulnerability will be available a… Vendor fix: Welch Allyn Product Configuration Tool versions 1.9.4.2: Available Q3 2024 Mitigation: No user action will be required once the update is released. Affected, fixed & timelineAffected:
Mitigation: Baxter recommends the following workarounds to help reduce risk: Mitigation: Apply proper network and physical security controls. Mitigation: The Welch Allyn Configuration Tool has been removed from public access. Customers are advised to contact Baxter Technical Support or their Baxter Project Manager to create configuration files, as needed. Baxter Technical Support can be reached at (800)535-6663, option 2. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-5176 | 9.4 Critical | Baxter Welch Allyn Configuration Tool Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This is… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.