CVE-2017-12724: A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infu...

Security readout for executives and security teams

This issue affects Smiths Medical Medfusion 4000 wireless syringe infusion pumps. If the pump is configured to allow FTP, the FTP service contains hard-coded credentials. That could undermine normal access controls for a clinical device, but the provided sources do not give CVSS severity, a patch, or evidence of active exploitation. Exposure is most likely where affected Medfusion 4000 pumps run versions 1.1, 1.5, or 1.6 and have FTP connectivity enabled. Reachability depends on local clinical network design and pump configuration. Treat this as a targeted medical-device exposure review, not an internet-wide emergency based on the provided evidence. Priority rises if affected pumps have FTP enabled or are reachable from broad hospital networks. Mitigation focus: Identify affected Medfusion 4000 pumps and software versions.; Check vendor and CISA ICS advisory guidance before changing clinical device settings.; Disable FTP access where it is not required and vendor guidance permits..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.