Baxter Phoenix Hemodialysis Delivery System (Update A)

An attacker with unauthorized access to the hospital network could intercept unencrypted communications to the Baxter Phoenix dialysis machine and read sensitive patient data or clinical parameters. This could expose protected health information (PHI) and compromise patient privacy.

Hospital and clinic operators responsible for dialysis services using Baxter Phoenix Hemodialysis Delivery System. This includes clinical engineers, IT staff managing medical device networks, and facility managers overseeing dialysis units. The vulnerability affects patient privacy in any facility running affected software versions 3.36 or 3.40.

An attacker on the same network segment as the Phoenix machine (or who has gained access to the hospital network via remote connections, VPN compromise, or insider access) can passively monitor or intercept network traffic to read sensitive unencrypted data transmitted by or to the dialysis delivery system.