CVE-2022-26388
Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph Devices
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:
Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:
Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph:
Versions 2.2.0 and prior.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph Devices
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:
Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:
Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph:
Versions 2.2.0 and prior.
- Record
CVE-2022-26388- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-259
- Updated
- 2026-11-02
EUVDEUVD-2022-30947
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:
Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:
Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph:
Versions 2.2.0 and prior.
- Record
EUVD-2022-30947- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4fpr-4qrv-r2vm
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI...
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:
Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:
Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph:
Versions 2.2.0 and prior.
- Record
GHSA-4fpr-4qrv-r2vm- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-259
- Updated
- 2026-11-02
NVD
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:
Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:
Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph:
Versions 2.2.0 and prior.
- Record
CVE-2022-26388- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-259
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-26388
A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph:
Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:
Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:
Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph:
Versions 2.2.0 and prior.
- Record
ALPINE-CVE-2022-26388- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdAlpine:v3.16 |
before 91.7.0-r0 | 91.7.0-r0 |
thunderbirdAlpine:v3.17 |
before 91.7.0-r0 | 91.7.0-r0 |
thunderbirdAlpine:v3.18 |
before 91.7.0-r0 | 91.7.0-r0 |
thunderbirdAlpine:v3.19 |
before 91.7.0-r0 | 91.7.0-r0 |
thunderbirdAlpine:v3.20 |
before 91.7.0-r0 | 91.7.0-r0 |
thunderbirdAlpine:v3.21 |
before 91.7.0-r0 | 91.7.0-r0 |
thunderbirdAlpine:v3.22 |
before 91.7.0-r0 | 91.7.0-r0 |
thunderbirdAlpine:v3.23 |
before 91.7.0-r0 | 91.7.0-r0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26388 is a medium vulnerability (CVSS 6.4) in Welch Allyn Eli 150c/bur 150c/mlbur 150c Resting Electrocardiograph, published February 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in thunderbird 91.7.0-r0.