CVE-2017-12720: An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion...

Security readout for executives and security teams

Some Medfusion 4000 wireless syringe infusion pumps can expose an FTP service that does not ask for a password when FTP is enabled. This is a healthcare device access-control weakness, so urgency depends on whether affected pumps are present and reachable on your network. Exposure is limited to organizations operating the named Medfusion 4000 pump versions with FTP enabled. The bundle does not establish default FTP state, internet exposure, or other affected products. Treat this as a high-priority medical-device exposure review, especially in hospitals using Medfusion 4000 pumps. Prioritize asset confirmation and FTP reachability before assuming enterprise-wide risk. Mitigation focus: Inventory Medfusion 4000 pumps and firmware versions.; Determine whether FTP access is enabled on each pump.; Consult the CISA advisory and vendor guidance for approved remediation..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.