CVE-2017-12726: A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusio...

Security readout for executives and security teams

CVE-2017-12726 is a hard-coded Telnet password issue in Smiths Medical Medfusion 4000 wireless syringe infusion pumps. It matters only when affected pumps are configured to allow external communications. The vendor assessment in the source says Telnet cannot upload files and impact is limited to the communications module. Exposure is most likely in healthcare environments using Medfusion 4000 pumps on networked clinical or biomedical engineering segments, especially where external communications are enabled or Telnet is reachable beyond tightly managed systems. Treat this as a targeted medical-device exposure review, not a broad internet emergency. Priority should be higher where pumps are network-accessible from shared hospital networks or poorly segmented environments. Mitigation focus: Inventory Medfusion 4000 pumps and identify versions 1.1, 1.5, and 1.6.; Check Smiths Medical or CISA advisory guidance for approved remediation details.; Disable external communications or Telnet access where not operationally required..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.