In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.

In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.

Due to improper sanitation of values of certain parameters, a remote, unauthenticated attacker could potentially run arbitrary SQL queries, access, modify and delete sensitive data and/or administrative operations including shutting down the database. A vulnerability in the application could potentially lead to an unauthorized user gaining access to patient and clinician information, modifying or deleting clinic details.