CVE-2020-12048

7.5 highEPSS 0.5%

High (7.5) in baxter phoenix x36 firmware. EPSS 0.5% chance of exploitation in the next 30 days.

Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-319
Published: 2020-06-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

baxter:phoenix_x36_firmware

References

https://www.us-cert.gov/ics/advisories/icsma-20-170-03
https://www.us-cert.gov/ics/advisories/icsma-20-170-03

Check your stack JSON