Cleartext Wi-Fi credentials and patient data

1. Summary

The Wireless Battery Module (WBM) of the Baxter SIGMA Spectrum Infusion Pump stores the hospital Wi-Fi credential — the SSID and the 64-character hexadecimal WPA pre-shared key — and, on Spectrum IQ auto-programming pumps, patient health information (PHI), in cleartext within non-volatile memory, with no automatic erasure on decommissioning [1][4]. The same credential is also transferred from pump to battery over an unencrypted internal UART link at power-up [4][6]. An attacker with physical possession of a WBM that has not been wiped — a lost, resold, or secondary-market unit — can disassemble the module and read out the credentials and patient data, or intercept the cleartext startup traffic [4]. Per the CVSS impact metrics (C:H/I:N/A:N), this is a confidentiality-only disclosure of network credentials and PHI; it does not by itself alter or disable therapy [1].

2. Affected products & versions

3. The vulnerability in detail

The flaw lives in the Wireless Battery Module (WBM), the Wi-Fi-enabled battery unit that clips onto the SIGMA Spectrum Infusion Pump and gives the pump network connectivity. Two specific locations inside the WBM are implicated: its non-volatile memory, where sensitive data is persisted, and the internal UART serial link between the pump body and the battery module, over which that data first arrives [4]. Understanding the bug requires following how a secret gets into the module and why it never leaves in a protected form.

When a WBM is attached and the pump is powered up, the pump hands the hospital Wi-Fi credential to the battery unit so the module can join the wireless network on the pump’s behalf [4][6]. That credential is the SSID plus a 64-character hexadecimal WPA pre-shared key — effectively the raw key material for the hospital’s wireless network. On Spectrum IQ auto-programming pumps, patient PHI and treatment data are likewise present on the module. The root cause, and the actual defect, is that the WBM writes all of this to non-volatile memory in cleartext, with no encryption at rest, and performs no automatic data-wipe when the device is decommissioned [1][4]. Compounding this, the handoff itself is unprotected: the credential travels pump-to-battery over the internal UART link unencrypted, so the same secret is exposed both at rest (in flash) and in transit (during startup) [4]. The secret is therefore persistent, plaintext, and recoverable by anyone who later holds the hardware.

The Baxter CNA record classifies this as CWE-311, Missing Encryption of Sensitive Data, while NVD assigns CWE-312, Cleartext Storage of Sensitive Information [1][2]. Both labels describe the same underlying mistake from slightly different angles: sensitive data that ought to be protected by cryptography is instead left in a form any reader can interpret. CWE-311 emphasizes the absence of an encryption step that should have been applied to the credential/PHI; CWE-312 emphasizes the resulting state — secrets sitting in the clear in storage. The device treats a network master key and patient data as if they were ordinary, non-secret configuration bytes, and it never scrubs them, so the data’s confidentiality depends entirely on nobody ever obtaining the physical module.

What makes the defect materially exploitable rather than theoretical is the medical-device hardware lifecycle. Infusion pumps and their battery modules are high-volume clinical inventory: they are routinely retired, transferred between facilities, returned to service providers, or sold. Rapid7 specifically notes that WBMs are easily purchased on the secondary market, including eBay [4]. Because the data is written in cleartext and is never auto-erased, a module that was ever in service on a configured wireless deployment still carries the SSID and WPA PSK — and, on Spectrum IQ auto-programming units, PHI — at the moment it leaves the hospital’s physical control. There is no time-based expiry, no tamper-triggered scrub, and no requirement that a technician clear settings before disposal; the burden falls entirely on operational hygiene that the device does not enforce. This is the pivot from “a battery stores a key” to “any later owner of the battery inherits the key.”

The exploitation chain is straightforward once physical access is obtained, though it demands hardware skill (which is why CVSS rates attack complexity high):

1. Acquire an unwiped WBM — a lost or improperly decommissioned unit, or a secondary-market purchase such as eBay — or gain physical access to a deployed pump-plus-WBM [4].
2. Path A (data at rest): install the WBM on a pump and power-cycle it, which causes the pump to transfer the Wi-Fi credential into the module’s non-volatile memory [4].
3. Physically remove and disassemble the WBM [4].
4. Reverse-engineer and read the non-volatile memory to extract the cleartext SSID, the 64-character hex WPA PSK, and any stored PHI (PHI only on Spectrum IQ auto-programming pumps) [1][4].
5. Path B (data in transit): alternatively, tap the internal UART link during pump startup and capture the SSID and 64-character hex PSK as they are sent unencrypted between pump and battery [4].
6. Reuse the recovered Wi-Fi credentials to authenticate to the hospital wireless network (if those credentials are shared or reusable across the deployment), and/or read out the disclosed PHI [4].

The two paths are worth holding apart because they have different preconditions and yield the same secret by different means. Path A is a post-hoc, offline extraction: it works on any module that was powered up while attached on a configured deployment, at any later time, and needs only the physical unit plus flash-reading equipment. Path B is a live, on-device intercept: it requires access to the pump during a boot cycle and a UART tap, but it sidesteps flash reverse-engineering entirely by catching the credential in the clear as it crosses the serial link. Path A is the one the secondary-market/decommissioning framing turns into a fleet-wide concern; Path B is the more targeted, physically-present variant. Both converge on disclosure of the SSID and 64-character hex WPA PSK, and neither requires any credential, prompt, or network foothold to begin.

Preconditions are narrow but realistic: the attacker needs physical access to a module whose data and settings were never erased. No network access, no authentication, and no user interaction are required (PR:N/UI:N), but the attack vector is physical (AV:P) and complexity is high (AC:H) because the adversary must open the module and reverse-engineer flash, or instrument the UART during boot [1]. Wi-Fi credentials are present on any WBM that was powered up while attached on a configured wireless deployment; PHI is present only on Spectrum IQ pumps using auto-programming [1][4].

The finder, Rapid7’s Deral Heiland, reproduced the issue on real hardware and documented the extraction methodology [4]. This is one of four related 2022 Baxter WBM CVEs (26390 credential storage; 26392/26393 format string; 26394 unauthenticated network reconfiguration) [4].

4. Discovery & timeline

The vulnerability was discovered and reported by Deral Heiland, Principal IoT Researcher at Rapid7 [4]. The coordinated-disclosure timeline [4]:

• April 20, 2022 — issues reported to Baxter.
• May 11, 2022 — Rapid7 requested a status update.
• June 1, 2022 — teleconference presenting findings; June–July follow-up conversations.
• August 2, 2022 — VINCE coordination with CERT/CC and ICS-CERT.
• August 31, 2022 — final review.
• September 8, 2022 — public disclosure and Baxter advisory release; the NVD/CVE.org record published on or around September 9, 2022 [2][4].

Baxter, the assigning CNA (productsecurity@baxter.com), responded not with a code fix but with decommissioning/data-erasure guidance, committing to add erase-before-decommission instructions to the Spectrum Operator’s Manual and to the CISA advisory [2][5][7].

5. Technical reference

• CVE: CVE-2022-26390 [1][2].
• CWE: CWE-311 (Missing Encryption of Sensitive Data) per Baxter CNA / CVE.org [2]; CWE-312 (Cleartext Storage of Sensitive Information) per NVD [1].
• CVSS v3.1: Base score 4.2 (MEDIUM), vector AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N [1]. The key metrics here: AV:P (physical access to the module is required), AC:H (the attacker must disassemble hardware and reverse-engineer flash or tap the UART), PR:N/UI:N (no privileges or user interaction once physical access is held), C:H (high confidentiality impact — full disclosure of Wi-Fi key material and PHI), and I:N/A:N (no integrity or availability impact; the flaw does not alter or stop therapy). The physical-access and high-complexity caps are what hold the base score to MEDIUM despite the high confidentiality impact.
• Code/commit refs: none; no code-level fixed firmware build is documented [5].
• Related CVEs: CVE-2022-26392, CVE-2022-26393 (format string), CVE-2022-26394 (unauthenticated network reconfiguration); all four tied together in CISA advisory ICSMA-22-251-01 [3][4].

6. Consequence & CFSE path analysis

Real-world consequence: a single unwiped WBM — lost, resold, or bought on the secondary market — hands an attacker the hospital’s cleartext Wi-Fi SSID and WPA pre-shared key, and on Spectrum IQ pumps, patient PHI. The immediate harm is confidentiality loss. The larger harm depends on deployment hygiene: if those Wi-Fi credentials are shared and reusable across the fleet, one recovered key becomes reusable network authority, and recovery requires fleet-wide credential rotation, not just retiring one device.

Why the CFSE Path Score differs from CVSS: CVSS scores this as a single 4.2 MEDIUM, dominated by the physical-access (AV:P) and high-complexity (AC:H) caps, treating the outcome as one bounded confidentiality event. The CFSE analysis instead decomposes the vulnerability into two co-dominant risk paths and asks where the harm actually goes after disclosure — which surfaces an authority-escalation dimension CVSS’s per-device confidentiality metric does not capture. The result is an overall path_verdict of HIGH, direction UNDER relative to the CVSS 4.2 MEDIUM baseline.

The CFSE path decomposition:

Verdict: HIGH. This analysis decomposes CVE-2022-26390 into two co-dominant risk paths, both banded HIGH, giving an overall path_verdict of HIGH (direction UNDER versus the CVSS 4.2 MEDIUM baseline).

ACCOUNT_AUTHORITY path (CPATH RE:1/EC:4/EX:1/PH:2/DP:3/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3): treats the recovered cleartext Wi-Fi credential as reusable hospital-network authority. Physical possession of one unwiped, lost, or resold Wireless Battery Module yields a straightforward extraction, and if credentials are shared/reusable across the deployment the harm bridges into the hospital network, forcing fleet-wide credential rotation to recover.

DATA_PRIVACY path (RE:1/EC:4/EX:1/PH:0/DP:3/AT:1/CH:2/SR:2/SX:1/OR:2/EV:3): captures the read-only disclosure of PHI and treatment data at rest, which CVSS largely already reflects; it is per-device rather than fleet-portable and requires wipe-before-decommission hygiene.

Both paths are reachability-bound (EX:1, low-exposure cap) and rest on physical access to an unwiped module, with Rapid7 having reproduced the issue on hardware (EV:3) and a vendor patch/guidance available (LS:PATCH_AVAILABLE). The overall HIGH verdict is driven by the authority path’s reusable-credential uplift, which the model notes should be reduced if a deployment uses per-device credentials, short lifetimes, and confirmed wiping.

In short: the DATA_PRIVACY path roughly matches what CVSS already reflects (per-device PHI disclosure), but the ACCOUNT_AUTHORITY path — reusable network key material bridging into the hospital network — is the uplift CVSS misses, and it is the driver of the HIGH verdict. That uplift is conditional: it collapses toward the CVSS view in deployments using per-device, short-lifetime Wi-Fi credentials with confirmed wiping.

7. Remediation & mitigations

Remediation is operational, not a code patch — no fixed firmware that removes the cleartext storage is documented [5].

• Erase all data and settings before decommissioning, resale, or transfer of any WBM or pump: reset/clear network settings (Wi-Fi SSID and WPA PSK), delete the drug library, and clear the history log [5][7]. This is the primary vendor-committed mitigation, to be documented in the Spectrum Operator’s Manual and the CISA advisory [7].
• Establish a formal de-acquisition / disposal process that purges PII/PHI and Wi-Fi/WPA/PSK configuration from every device before it leaves the facility’s control [6]. This directly closes the secondary-market exposure path, since a purged module carries no SSID, PSK, or PHI for a later owner to recover.
• Rotate any Wi-Fi/WPA credentials that may have been exposed on lost, resold, or improperly wiped modules, and purge the Wi-Fi/WPA/PSK configuration from devices before they change hands [6]. Rotation is what neutralizes an already-leaked key. Additionally, preferring per-device and short-lifetime Wi-Fi credentials would collapse the ACCOUNT_AUTHORITY uplift described in Section 6 by making any recovered key neither fleet-wide nor long-lived — (the specific “per-device / short-lifetime” recommendation is a reasoned inference from the Section 6 analysis and is not directly stated in public advisories; source [6] supports purging and rotating exposed Wi-Fi/WPA/PSK configuration).
• Because the exposure is physical and lifecycle-driven, controls that reduce loss of physical inventory and secondary-market leakage (asset tracking of WBMs, verified wipe at end of life) are the meaningful detection/prevention levers; there is no network-side signature for this bug.

8. Sources

1. NVD — CVE-2022-26390 — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2022-26390 — Canonical record: official description of cleartext credential/PHI storage, CVSS 4.2 vector, CWE-312, and the affected WBM firmware list. Credibility: primary-advisory.
2. CVE-2022-26390 CVE Record — MITRE / CVE.org — https://www.cve.org/CVERecord?id=CVE-2022-26390 — Authoritative CVE record confirming Baxter as CNA, the CWE-311 classification, CVSS 4.2, affected versions, and ~Sept 9, 2022 publication. Credibility: primary-advisory.
3. Baxter Sigma Spectrum Infusion Pumps (ICSMA-22-251-01, Update A) — CISA (ICS-Medical) — https://www.cisa.gov/news-events/ics-medical-advisories/icsma-22-251-01 — Government advisory tying together all four 2022 WBM CVEs with versions, CVSS, and mitigations. Credibility: primary-advisory.
4. Baxter SIGMA Spectrum Infusion Pumps: Multiple Vulnerabilities (FIXED) — Rapid7 (Deral Heiland) — https://www.rapid7.com/blog/post/2022/09/08/baxter-sigma-spectrum-infusion-pumps-multiple-vulnerabilities-fixed/ — Original finder disclosure: reproduction methodology, UART-tap alternative, secondary-market/decommissioning framing, all four CVEs, and the disclosure timeline. Credibility: researcher-primary.
5. Product Security Bulletin: Spectrum V6/V8/IQ WBM Vulnerabilities (ICSMA-22-251-01) — Baxter (vendor) — https://www.baxter.com/sites/g/files/ebysai3896/files/2023-08/Bulletin_ICSMA-22-251-01_Update_08022023.pdf — Vendor’s own bulletin: official position and decommissioning/wipe guidance (reset network settings, delete drug library, clear history log). Credibility: primary-advisory.
6. New Vulnerabilities Reported in Baxter’s Internet-Connected Infusion Pumps — The Hacker News — https://thehackernews.com/2022/09/new-vulnerabilities-reported-in-baxters.html — Technical press: explains the power-up credential transfer mechanism, notes no public exploits, and summarizes the erase-before-disposal recommendation (purge PII and Wi-Fi/WPA/PSK config before resale or transfer). Credibility: reputable-press.
7. 4 Vulnerabilities Identified in Baxter & Sigma Spectrum Infusion Pumps — HIPAA Journal — https://www.hipaajournal.com/4-vulnerabilities-identified-in-baxter-sigma-spectrum-infusion-pumps/ — Healthcare-security press: PHI/credential-leakage and decommissioning-risk framing; confirms no in-the-wild exploitation and the operator’s-manual guidance commitment. Credibility: reputable-press.
8. Baxter Sigma Spectrum Infusion Pump Vulnerabilities (CC-4175) — NHS England Digital — https://digital.nhs.uk/cyber-alerts/2022/cc-4175 — Independent national-CERT-style alert corroborating the four CVEs, affected versions, and mitigations. Credibility: reputable-press.