{"id":"CVE-2022-26389","aliases":["EUVD-2022-30948","GHSA-9qm3-wmwv-68w5"],"status":"published","title":"Improper Access Control Vulnerability in ELI Electrocardiograph Devices","description":"An improper access control vulnerability may allow privilege escalation.This issue affects: \n\n  *  ELI 380 Resting Electrocardiograph:\n\nVersions 2.6.0 and prior; \n  *  ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; \n  *  ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; \n  *  ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00287,"percentile":0.21441,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2025-02-07T17:07:27Z","modified":"2026-06-17T04:35:08Z","products":[{"vendor":"baxter/ hillrom","product":"eli 380 resting  electrocardiograph"},{"vendor":"welch allyn","product":"eli 150c/bur 150c/mlbur 150c resting electrocardiograph"},{"vendor":"welch allyn","product":"eli 250c/bur 250c resting electrocardiograph"},{"vendor":"welch allyn","product":"eli 280/bur280/mlbur 280 resting electrocardiograph"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-22-167-01"},{"url":"https://hillrom.com/en/responsible-disclosures/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26389"},{"url":"https://hillrom.com/en/responsible-disclosures"},{"url":"https://github.com/advisories/GHSA-9qm3-wmwv-68w5"}],"sources":{"cve":[{"id":"CVE-2022-26389","title":"Improper Access Control Vulnerability in ELI Electrocardiograph Devices","description":"An improper access control vulnerability may allow privilege escalation.This issue affects: \n\n  *  ELI 380 Resting Electrocardiograph:\n\nVersions 2.6.0 and prior; \n  *  ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; \n  *  ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; \n  *  ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T17:07:27.929Z","modified":"2025-02-07T18:49:22.506Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-30948","description":"An improper access control vulnerability may allow privilege escalation.This issue affects: \n\n  *  ELI 380 Resting Electrocardiograph:\n\nVersions 2.6.0 and prior; \n  *  ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; \n  *  ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; \n  *  ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T17:07:27Z","modified":"2025-02-07T18:49:22Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:01.828429Z"}],"ghsa":[{"id":"GHSA-9qm3-wmwv-68w5","title":"An improper access control vulnerability may allow privilege escalation.This issue affects: \n\n  *...","description":"An improper access control vulnerability may allow privilege escalation.This issue affects: \n\n  *  ELI 380 Resting Electrocardiograph:\n\nVersions 2.6.0 and prior; \n  *  ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; \n  *  ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; \n  *  ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T18:31:22Z","modified":"2025-02-07T18:31:28Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:59:50.611216Z"}],"nvd":[{"id":"CVE-2022-26389","description":"An improper access control vulnerability may allow privilege escalation.This issue affects: \n\n  *  ELI 380 Resting Electrocardiograph:\n\nVersions 2.6.0 and prior; \n  *  ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:\n\nVersions 2.3.1 and prior; \n  *  ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; \n  *  ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: \n\nVersions 2.2.0 and prior.","status":"published","published":"2025-02-07T17:15:22.13Z","modified":"2026-06-17T04:35:08.703Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:40.977475Z"}]}}