{"id":"CVE-2022-26388","aliases":["ALPINE-CVE-2022-26388","EUVD-2022-30947","GHSA-4fpr-4qrv-r2vm"],"status":"published","title":"Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph Devices","description":"A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: \n\nVersions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:\n\nVersions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00266,"percentile":0.18689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-259"],"published":"2025-02-07T17:06:30Z","modified":"2026-11-03T07:30:19Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"thunderbird","fixed_in":["91.7.0-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.7.0-r0"}]}]}],"products":[{"vendor":"welch allyn","product":"eli 150c/bur 150c/mlbur 150c resting electrocardiograph"},{"vendor":"welch allyn","product":"eli 250c/bur 250c resting electrocardiograph"},{"vendor":"welch allyn","product":"eli 280/bur280/mlbur 280 resting electrocardiograph"},{"vendor":"welch allyn","product":"eli 380 resting electrocardiograph"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-22-167-01"},{"url":"https://hillrom.com/en/responsible-disclosures/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26388"},{"url":"https://hillrom.com/en/responsible-disclosures"},{"url":"https://github.com/advisories/GHSA-4fpr-4qrv-r2vm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-26388","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-26388","title":"Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph Devices","description":"A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: \n\nVersions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:\n\nVersions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T17:06:30.134Z","modified":"2025-02-07T18:50:58.812Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-259"],"updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-30947","description":"A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: \n\nVersions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:\n\nVersions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T17:06:30Z","modified":"2025-02-07T18:50:58Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:01.828429Z"}],"ghsa":[{"id":"GHSA-4fpr-4qrv-r2vm","title":"A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI...","description":"A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: \n\nVersions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:\n\nVersions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T18:31:22Z","modified":"2025-02-07T18:31:28Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-259"],"updated_at":"2026-11-02T14:59:50.611216Z"}],"nvd":[{"id":"CVE-2022-26388","description":"A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: \n\nVersions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:\n\nVersions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T17:15:21.96Z","modified":"2026-06-17T04:35:08.587Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-259"],"updated_at":"2026-11-02T14:07:40.977475Z"}],"osv":[{"id":"ALPINE-CVE-2022-26388","description":"A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: \n\nVersions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:\n\nVersions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T17:15:21.96Z","modified":"2026-11-03T07:30:19.263917253Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"}]}}