CVE-2022-26388
Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph Devices
- Published
- Updated
- Reserved
- Assigned by
- Baxter
Description
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph: Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: Versions 2.2.0 and prior.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| BaxterCNA (assigner) | 3.1 | Medium6.4 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| NVDNVD · Deferred | 3.1 | Medium6.4 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
- EPSS (exploitation in 30 days)
- 0.27% · top 81% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.
Weakness
Affected products
Welch Allyn · ELI 380 Resting Electrocardiograph
- affected ≤ 2.6.0
Welch Allyn · ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph
- affected ≤ 2.3.1
Welch Allyn · ELI 250c/BUR 250c Resting Electrocardiograph
- affected ≤ 2.1.2
Welch Allyn · ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph
- affected ≤ 2.2.0
What to do
Solution: Hillrom has released software updates for all impacted devices to address these vulnerabilities. New product versions that mitigate these vulnerabilities are available as follows: * Welch Allyn ELI 380 Resting Electrocardiograph: available Q4 2023 * Welch Allyn ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph: available May 2022 * Welch Allyn ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: available Q4 2023 Hillrom recommends users upgrade to the latest product versions. Information on how to update these products can be found on the Hillrom disclosure page https://hillrom.com/en/responsible-disclosures/ .
Workaround: Hillrom recommends the following workarounds to help reduce risk: * Apply proper network and physical security controls. * Ensure a unique encryption key is configured for ELI Link and Cardiograph. * Where possible, use a firewall to prevent communication on Port 21 FTP service, Port 22 SSH (Secure Shell Connection), and Port 23 Telnet service.
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-26388)Record last updated .