Search
Find a vulnerability
Search criteria
11 vulnerabilities by bbraun
VAR-201706-0454
Vulnerability from variot - Updated: 2025-04-20 23:27An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input. B. Braun Medical SpaceCom The module contains an open redirect vulnerability.Information may be obtained and information may be altered. Braun SpaceCom Module is a product used to facilitate the exchange of medical system information, used to connect hospital network systems and external clinical systems, input data, medical history and service information to connected workstations. An attacker could exploit the vulnerability to post a specially crafted URI and instruct the user to click to redirect the user to an attacker-controlled website, causing a phishing attack. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible. Versions prior to SpaceCom module 012U000040 are vulnerable. B.Braun Medical SpaceCom module is a product communication module of B.Braun Medical Company in the United States. An attacker can redirect users to arbitrary URLs
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201706-0454",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "station",
"scope": "eq",
"trust": 1.6,
"vendor": "bbraun",
"version": null
},
{
"model": "braun spacecom module",
"scope": "eq",
"trust": 0.9,
"vendor": "b",
"version": "0"
},
{
"model": "spacestation software",
"scope": "lt",
"trust": 0.8,
"vendor": "b brown a scrap",
"version": "012u000040"
},
{
"model": "braun spacecom module 012u000040",
"scope": "ne",
"trust": 0.3,
"vendor": "b",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "station",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "BID",
"id": "98624"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
},
{
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:bbraun:station_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Marc Ruef and Rocco Gagliardi of scip AG.",
"sources": [
{
"db": "BID",
"id": "98624"
}
],
"trust": 0.3
},
"cve": "CVE-2017-6018",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-6018",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-10575",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-114221",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2017-6018",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-6018",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-6018",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2017-10575",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201702-594",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-114221",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "VULHUB",
"id": "VHN-114221"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
},
{
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input. B. Braun Medical SpaceCom The module contains an open redirect vulnerability.Information may be obtained and information may be altered. Braun SpaceCom Module is a product used to facilitate the exchange of medical system information, used to connect hospital network systems and external clinical systems, input data, medical history and service information to connected workstations. An attacker could exploit the vulnerability to post a specially crafted URI and instruct the user to click to redirect the user to an attacker-controlled website, causing a phishing attack. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible. \nVersions prior to SpaceCom module 012U000040 are vulnerable. B.Braun Medical SpaceCom module is a product communication module of B.Braun Medical Company in the United States. An attacker can redirect users to arbitrary URLs",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-6018"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "BID",
"id": "98624"
},
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "VULHUB",
"id": "VHN-114221"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-6018",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSMA-17-082-02",
"trust": 2.8
},
{
"db": "BID",
"id": "98624",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-10575",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073",
"trust": 0.8
},
{
"db": "IVD",
"id": "BA0BEADE-70F9-49D8-81ED-8E81D4C51FC7",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-114221",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "VULHUB",
"id": "VHN-114221"
},
{
"db": "BID",
"id": "98624"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
},
{
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"id": "VAR-201706-0454",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "VULHUB",
"id": "VHN-114221"
}
],
"trust": 1.65
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
}
]
},
"last_update_date": "2025-04-20T23:27:23.764000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "B. Braun SpaceCom",
"trust": 0.8,
"url": "https://www.bbraun.com/en/products/b/b-braun-spacecom.html"
},
{
"title": "B. Braun SpaceCom Module Open Redirection Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/95388"
},
{
"title": "B.Braun Medical SpaceCom Fixes for module input validation error vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=100375"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-601",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-114221"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-17-082-02"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6018"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-6018"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/98624"
},
{
"trust": 0.3,
"url": "http://www.bbraun.co.in/cps/rde/xchg/cw-bbraun-hi-in/hs.xsl/products.html?prid=prid00001838"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "VULHUB",
"id": "VHN-114221"
},
{
"db": "BID",
"id": "98624"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
},
{
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"db": "VULHUB",
"id": "VHN-114221"
},
{
"db": "BID",
"id": "98624"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
},
{
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-06-22T00:00:00",
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"date": "2017-06-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"date": "2017-06-30T00:00:00",
"db": "VULHUB",
"id": "VHN-114221"
},
{
"date": "2017-05-23T00:00:00",
"db": "BID",
"id": "98624"
},
{
"date": "2017-08-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"date": "2017-02-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201702-594"
},
{
"date": "2017-06-30T03:29:00.267000",
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-06-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-10575"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-114221"
},
{
"date": "2017-05-23T00:00:00",
"db": "BID",
"id": "98624"
},
{
"date": "2017-08-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006073"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201702-594"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-6018"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "B. Braun SpaceCom Module Open redirection vulnerability",
"sources": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "CNVD",
"id": "CNVD-2017-10575"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input validation error",
"sources": [
{
"db": "IVD",
"id": "ba0beade-70f9-49d8-81ed-8e81d4c51fc7"
},
{
"db": "BID",
"id": "98624"
},
{
"db": "CNNVD",
"id": "CNNVD-201702-594"
}
],
"trust": 1.1
}
}
VAR-202010-1585
Vulnerability from variot - Updated: 2025-01-30 19:38Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enable attackers with command line access to access the device’s Wi-Fi module. B.Braun Melsungen Multiple products provided by Co., Ltd. contain multiple vulnerabilities listed below. * Reflected cross-site scripting (CWE-79) - CVE-2020-25158 It was * Open redirect (CWE-601) - CVE-2020-25154 It was * XPATH injection (CWE-643) - CVE-2020-25162 It was * Session immobilization (CWE-384) - CVE-2020-25152 It was * Salt Using hash functions without (CWE-759) - CVE-2020-25164 It was * relative path traversal (CWE-23) - CVE-2020-25150 It was * Improper verification of digital signatures (CWE-347) - CVE-2020-25166 It was * Improper authority management (CWE-269) - CVE-2020-16238 It was * Use hard-coded credentials (CWE-798) - CVE-2020-25168 It was * Residual debug code (CWE-489) - CVE-2020-25156 It was * Inappropriate access control (CWE-284) - CVE-2020-25160The expected impact depends on each vulnerability, but it may be affected as follows. It was * by a remote third party for administrative purposes Web Arbitrary scripts or HTML is inserted - CVE-2020-25158 It was * A remote third party redirects the user to a malicious website - CVE-2020-25154 It was * Theft of sensitive information or escalation of privileges by an unauthenticated remote third party - CVE-2020-25162 It was * By a remote third party Web Session stolen or privilege escalation - CVE-2020-25152 It was * A local third party steals user credentials for the administrator interface - CVE-2020-25164 It was * Execute arbitrary commands by uploading a specially crafted file by a remote user - CVE-2020-25150 It was * Malicious firmware that can tamper with the device is generated by a third party with access to the product - CVE-2020-25166 It was * by a third party, from the command line on the underlying Linux After connecting to the system, root elevated to privilege - CVE-2020-16238 It was * Based on the authentication information hard-coded by a third party, the device can be operated from the command line. Wi-Fi connected to the module - CVE-2020-25168 It was * By a remote third party root Connected to the device with authorization - CVE-2020-25156 It was * The network configuration information of the device is stolen or tampered with by a third party - CVE-2020-25160
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202010-1585",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "spacecom",
"scope": "lte",
"trust": 1.0,
"vendor": "bbraun",
"version": "l81"
},
{
"model": "datamodule compactplus",
"scope": "eq",
"trust": 1.0,
"vendor": "bbraun",
"version": "a11"
},
{
"model": "datamodule compactplus",
"scope": "eq",
"trust": 1.0,
"vendor": "bbraun",
"version": "a10"
},
{
"model": "data module compactplus",
"scope": null,
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": null
},
{
"model": "spacecom",
"scope": "lte",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": "u61 and earlier"
},
{
"model": "battery pack with wi-fi",
"scope": null,
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": null
},
{
"model": "spacecom",
"scope": "lte",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": "l81 and earlier"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"cve": "CVE-2020-25168",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2020-25168",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.1,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.8,
"id": "CVE-2020-25168",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "JPCERT/CC",
"availabilityImpact": "None",
"baseScore": 3.3,
"baseSeverity": "Low",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2020-009257",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-25168",
"trust": 1.0,
"value": "LOW"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2020-25168",
"trust": 1.0,
"value": "LOW"
},
{
"author": "JPCERT/CC",
"id": "JVNDB-2020-009257",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-202010-1254",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULMON",
"id": "CVE-2020-25168",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-25168"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1254"
},
{
"db": "NVD",
"id": "CVE-2020-25168"
},
{
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enable attackers with command line access to access the device\u2019s Wi-Fi module. B.Braun Melsungen Multiple products provided by Co., Ltd. contain multiple vulnerabilities listed below. * Reflected cross-site scripting (CWE-79) - CVE-2020-25158 It was * Open redirect (CWE-601) - CVE-2020-25154 It was * XPATH injection (CWE-643) - CVE-2020-25162 It was * Session immobilization (CWE-384) - CVE-2020-25152 It was * Salt Using hash functions without (CWE-759) - CVE-2020-25164 It was * relative path traversal (CWE-23) - CVE-2020-25150 It was * Improper verification of digital signatures (CWE-347) - CVE-2020-25166 It was * Improper authority management (CWE-269) - CVE-2020-16238 It was * Use hard-coded credentials (CWE-798) - CVE-2020-25168 It was * Residual debug code (CWE-489) - CVE-2020-25156 It was * Inappropriate access control (CWE-284) - CVE-2020-25160The expected impact depends on each vulnerability, but it may be affected as follows. It was * by a remote third party for administrative purposes Web Arbitrary scripts or HTML is inserted - CVE-2020-25158 It was * A remote third party redirects the user to a malicious website - CVE-2020-25154 It was * Theft of sensitive information or escalation of privileges by an unauthenticated remote third party - CVE-2020-25162 It was * By a remote third party Web Session stolen or privilege escalation - CVE-2020-25152 It was * A local third party steals user credentials for the administrator interface - CVE-2020-25164 It was * Execute arbitrary commands by uploading a specially crafted file by a remote user - CVE-2020-25150 It was * Malicious firmware that can tamper with the device is generated by a third party with access to the product - CVE-2020-25166 It was * by a third party, from the command line on the underlying Linux After connecting to the system, root elevated to privilege - CVE-2020-16238 It was * Based on the authentication information hard-coded by a third party, the device can be operated from the command line. Wi-Fi connected to the module - CVE-2020-25168 It was * By a remote third party root Connected to the device with authorization - CVE-2020-25156 It was * The network configuration information of the device is stolen or tampered with by a third party - CVE-2020-25160",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25168"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "VULMON",
"id": "CVE-2020-25168"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-25168",
"trust": 2.6
},
{
"db": "ICS CERT",
"id": "ICSMA-20-296-02",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU94780329",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU91051134",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009257",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2022.5282",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.3661",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1254",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2020-25168",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2020-25168"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1254"
},
{
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"id": "VAR-202010-1585",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
}
],
"trust": 0.01
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
}
]
},
"last_update_date": "2025-01-30T19:38:59.735000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "10/2020\u00a0SpaceCom,\u00a0Battery\u00a0Pack\u00a0SP\u00a0with\u00a0WiFi,\u00a0Data\u00a0module\u00a0compactplus\u00a0-\u00a0multiple\u00a0vulnerabilities",
"trust": 0.8,
"url": "https://www.bbraun.com/en/products-and-solutions/temp/b--braun-coordinated-vulnerability-disclosure/security-advisory/spacecom--battery-pack-sp-with-wifi--data-module-compactplus---m0.html"
},
{
"title": "Multiple B. Braun Melsungen AG Product security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=131544"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1254"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-798",
"trust": 1.0
},
{
"problemtype": "Cross-site scripting (CWE-79) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " Open redirect (CWE-601) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": "Xpath injection (CWE-643) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " Session immobilization (CWE-384) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": "Salt Using one-way hash without using (CWE-759) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " Relative past traversal (CWE-23) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " Improper verification of digital signatures (CWE-347) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " Improper authority management (CWE-269) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use hard-coded credentials (CWE-798) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " debug code in active state (CWE-489) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " Inappropriate access control (CWE-284) [IPA evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02"
},
{
"trust": 1.7,
"url": "https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-02"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu94780329/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu91051134/index.html"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2020-25168/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.5282"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3661/"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2020-25168"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1254"
},
{
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2020-25168"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1254"
},
{
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-04-14T00:00:00",
"db": "VULMON",
"id": "CVE-2020-25168"
},
{
"date": "2020-10-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202010-1254"
},
{
"date": "2022-04-14T21:15:08.357000",
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-04-21T00:00:00",
"db": "VULMON",
"id": "CVE-2020-25168"
},
{
"date": "2022-10-24T05:45:00",
"db": "JVNDB",
"id": "JVNDB-2020-009257"
},
{
"date": "2022-10-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202010-1254"
},
{
"date": "2022-04-21T18:17:15.667000",
"db": "NVD",
"id": "CVE-2020-25168"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202010-1254"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0B.\u00a0Braun\u00a0Melsungen\u00a0 Multiple vulnerabilities in product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-009257"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202010-1254"
}
],
"trust": 0.6
}
}
VAR-202108-1770
Vulnerability from variot - Updated: 2024-08-14 13:53A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration. B. Braun SpaceCom2 is a hardware device from B. Braun, Germany, which is used to connect external devices to record data in a patient data management system, PC or USB memory stick. Braun SpaceCom2 versions prior to 012U000062 have a security vulnerability
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202108-1770",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "spacecom2",
"scope": "lt",
"trust": 1.0,
"vendor": "bbraun",
"version": "012u000062"
},
{
"model": "spacecom2",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": null
},
{
"model": "spacecom2",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": "012u000062"
},
{
"model": "braun spacecom2 \u003c012u000062",
"scope": null,
"trust": 0.6,
"vendor": "b",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Douglas McKee and Philippe Laulheret of McAfee reported these vulnerabilities to B. Braun.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
}
],
"trust": 0.6
},
"cve": "CVE-2021-33883",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2021-33883",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2022-22469",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2021-33883",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "cve@mitre.org",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.2,
"id": "CVE-2021-33883",
"impactScore": 3.6,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-33883",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-33883",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cve@mitre.org",
"id": "CVE-2021-33883",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2021-33883",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2022-22469",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202108-2339",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2021-33883",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"db": "VULMON",
"id": "CVE-2021-33883"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
},
{
"db": "NVD",
"id": "CVE-2021-33883"
},
{
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump\u0027s internal configuration. B. Braun SpaceCom2 is a hardware device from B. Braun, Germany, which is used to connect external devices to record data in a patient data management system, PC or USB memory stick. Braun SpaceCom2 versions prior to 012U000062 have a security vulnerability",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-33883"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"db": "VULMON",
"id": "CVE-2021-33883"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-33883",
"trust": 3.1
},
{
"db": "ICS CERT",
"id": "ICSMA-21-294-01",
"trust": 1.4
},
{
"db": "JVN",
"id": "JVNVU93193058",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2022-22469",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3526",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.5281",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021102506",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2339",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-33883",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"db": "VULMON",
"id": "CVE-2021-33883"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
},
{
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"id": "VAR-202108-1770",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
}
]
},
"last_update_date": "2024-08-14T13:53:56.164000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.bbraun.com/en.html"
},
{
"title": "Patch for B. Braun SpaceCom2 has an unknown vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/327416"
},
{
"title": "B. Braun SpaceCom2 Security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=161278"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-319",
"trust": 1.0
},
{
"problemtype": "Sending important information in clear text (CWE-319) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/"
},
{
"trust": 1.7,
"url": "https://www.bbraunusa.com/en.htm"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-294-01"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93193058//"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33883"
},
{
"trust": 0.6,
"url": "https://www.bbraunusa.com/en.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.5281"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021102506"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3526"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/319.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"db": "VULMON",
"id": "CVE-2021-33883"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
},
{
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"db": "VULMON",
"id": "CVE-2021-33883"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
},
{
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"date": "2021-08-25T00:00:00",
"db": "VULMON",
"id": "CVE-2021-33883"
},
{
"date": "2021-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"date": "2021-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202108-2339"
},
{
"date": "2021-08-25T12:15:16.160000",
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-22469"
},
{
"date": "2021-09-01T00:00:00",
"db": "VULMON",
"id": "CVE-2021-33883"
},
{
"date": "2021-10-25T05:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-003361"
},
{
"date": "2022-10-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202108-2339"
},
{
"date": "2021-09-01T16:03:38.857000",
"db": "NVD",
"id": "CVE-2021-33883"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "B.\u00a0Braun\u00a0SpaceCom2\u00a0 Vulnerability in plaintext transmission of important information in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003361"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2339"
}
],
"trust": 0.6
}
}
VAR-202108-1773
Vulnerability from variot - Updated: 2024-08-14 13:53An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device. B. Braun SpaceCom2 Is vulnerable to input validation.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Braun SpaceCom2 is a hardware device from B. Braun, Germany, for connecting external devices to record data in a patient data management system, PC or USB memory stick. Braun SpaceCom2 versions prior to 012U000062 have an input validation error vulnerability. Gain user-level command line access
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202108-1773",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "spacecom2",
"scope": "lt",
"trust": 1.0,
"vendor": "bbraun",
"version": "012u000062"
},
{
"model": "spacecom2",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": null
},
{
"model": "spacecom2",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": "012u000062"
},
{
"model": "braun spacecom2 \u003c012u000062",
"scope": null,
"trust": 0.6,
"vendor": "b",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Douglas McKee and Philippe Laulheret of McAfee reported these vulnerabilities to B. Braun.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2342"
}
],
"trust": 0.6
},
"cve": "CVE-2021-33886",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CVE-2021-33886",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CNVD-2022-22470",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2021-33886",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "cve@mitre.org",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2021-33886",
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-33886",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-33886",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cve@mitre.org",
"id": "CVE-2021-33886",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2021-33886",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2022-22470",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202108-2342",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2021-33886",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"db": "VULMON",
"id": "CVE-2021-33886"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2342"
},
{
"db": "NVD",
"id": "CVE-2021-33886"
},
{
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device. B. Braun SpaceCom2 Is vulnerable to input validation.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Braun SpaceCom2 is a hardware device from B. Braun, Germany, for connecting external devices to record data in a patient data management system, PC or USB memory stick. Braun SpaceCom2 versions prior to 012U000062 have an input validation error vulnerability. Gain user-level command line access",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-33886"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"db": "VULMON",
"id": "CVE-2021-33886"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-33886",
"trust": 3.1
},
{
"db": "ICS CERT",
"id": "ICSMA-21-294-01",
"trust": 1.5
},
{
"db": "JVN",
"id": "JVNVU93193058",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003358",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2022-22470",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3526",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.5281",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021102506",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2342",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-33886",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"db": "VULMON",
"id": "CVE-2021-33886"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2342"
},
{
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"id": "VAR-202108-1773",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22470"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22470"
}
]
},
"last_update_date": "2024-08-14T13:53:56.103000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.bbraun.com/en.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-134",
"trust": 1.0
},
{
"problemtype": "Incorrect input confirmation (CWE-20) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/"
},
{
"trust": 1.7,
"url": "https://www.bbraunusa.com/en.htm"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-294-01"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93193058//"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33886"
},
{
"trust": 0.6,
"url": "https://www.bbraunusa.com/en.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.5281"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021102506"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3526"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/134.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-294-01"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"db": "VULMON",
"id": "CVE-2021-33886"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2342"
},
{
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"db": "VULMON",
"id": "CVE-2021-33886"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2342"
},
{
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"date": "2021-08-25T00:00:00",
"db": "VULMON",
"id": "CVE-2021-33886"
},
{
"date": "2021-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"date": "2021-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202108-2342"
},
{
"date": "2021-08-25T12:15:17.130000",
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-22470"
},
{
"date": "2022-07-12T00:00:00",
"db": "VULMON",
"id": "CVE-2021-33886"
},
{
"date": "2021-10-25T05:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-003358"
},
{
"date": "2022-10-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202108-2342"
},
{
"date": "2022-07-12T17:42:04.277000",
"db": "NVD",
"id": "CVE-2021-33886"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2342"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "B.\u00a0Braun\u00a0SpaceCom2\u00a0 Input confirmation vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003358"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "format string error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2342"
}
],
"trust": 0.6
}
}
VAR-202108-1299
Vulnerability from variot - Updated: 2024-08-14 13:53A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands. B. Braun SpaceCom2 is a hardware device from B. Braun, Germany, which is used to connect external devices to record data in a patient data management system, PC or USB memory stick
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202108-1299",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "spacecom2",
"scope": "lt",
"trust": 1.0,
"vendor": "bbraun",
"version": "012u000062"
},
{
"model": "spacecom2",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": null
},
{
"model": "spacecom2",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30d3\u30fc \u30d6\u30e9\u30a6\u30f3\u30a8\u30fc\u30b9\u30af\u30e9\u30c3\u30d7\u682a\u5f0f\u4f1a\u793e",
"version": "012u000062"
},
{
"model": "braun spacecom2 \u003c012u000062",
"scope": null,
"trust": 0.6,
"vendor": "b",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Douglas McKee and Philippe Laulheret of McAfee reported these vulnerabilities to B. Braun.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
}
],
"trust": 0.6
},
"cve": "CVE-2021-33882",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2021-33882",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2022-22468",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2021-33882",
"impactScore": 4.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "cve@mitre.org",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.2,
"id": "CVE-2021-33882",
"impactScore": 4.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 8.6,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2021-33882",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-33882",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cve@mitre.org",
"id": "CVE-2021-33882",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2021-33882",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2022-22468",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202108-2336",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2021-33882",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "VULMON",
"id": "CVE-2021-33882"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
},
{
"db": "NVD",
"id": "CVE-2021-33882"
},
{
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands. B. Braun SpaceCom2 is a hardware device from B. Braun, Germany, which is used to connect external devices to record data in a patient data management system, PC or USB memory stick",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-33882"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "VULMON",
"id": "CVE-2021-33882"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-33882",
"trust": 3.1
},
{
"db": "ICS CERT",
"id": "ICSMA-21-294-01",
"trust": 1.4
},
{
"db": "JVN",
"id": "JVNVU93193058",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2022-22468",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3526",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.5281",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021102506",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2336",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-33882",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "VULMON",
"id": "CVE-2021-33882"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
},
{
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"id": "VAR-202108-1299",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
}
]
},
"last_update_date": "2024-08-14T13:53:56.043000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.bbraun.com/en.html"
},
{
"title": "Patch for B. Braun SpaceCom2 Access Control Error Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/327421"
},
{
"title": "B. Braun SpaceCom2 Fixes for access control error vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=161277"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for important features (CWE-306) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/"
},
{
"trust": 1.7,
"url": "https://www.bbraunusa.com/en.htm"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-294-01"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93193058//"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33882"
},
{
"trust": 0.6,
"url": "https://www.bbraunusa.com/en.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.5281"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021102506"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3526"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/306.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "VULMON",
"id": "CVE-2021-33882"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
},
{
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "VULMON",
"id": "CVE-2021-33882"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
},
{
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"date": "2021-08-25T00:00:00",
"db": "VULMON",
"id": "CVE-2021-33882"
},
{
"date": "2021-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"date": "2021-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202108-2336"
},
{
"date": "2021-08-25T12:15:13.410000",
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"date": "2021-09-01T00:00:00",
"db": "VULMON",
"id": "CVE-2021-33882"
},
{
"date": "2021-10-25T05:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-003362"
},
{
"date": "2022-10-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202108-2336"
},
{
"date": "2021-09-01T15:52:21.417000",
"db": "NVD",
"id": "CVE-2021-33882"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "B. Braun SpaceCom2 Access Control Error Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-22468"
},
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "access control error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202108-2336"
}
],
"trust": 0.6
}
}
CVE-2020-25174 (GCVE-0-2020-25174)
Vulnerability from nvd – Published: 2020-11-06 16:08 – Updated: 2024-09-17 00:16
VLAI
EPSS
VEX
Title
B. Braun OnlineSuite
Summary
A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user.
Severity
No CVSS data available.
CWE
- CWE-427 - UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| B. Braun Melsungen AG | OnlineSuite |
Affected:
AP , ≤ 3.0
(custom)
|
Date Public
2020-10-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:10.187Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OnlineSuite",
"vendor": "B. Braun Melsungen AG",
"versions": [
{
"lessThanOrEqual": "3.0",
"status": "affected",
"version": "AP",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-06T16:08:41.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
},
"title": "B. Braun OnlineSuite",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-10-22T15:00:00.000Z",
"ID": "CVE-2020-25174",
"STATE": "PUBLIC",
"TITLE": "B. Braun OnlineSuite"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OnlineSuite",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "AP",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "B. Braun Melsungen AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
]
},
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25174",
"datePublished": "2020-11-06T16:08:41.727Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:16:15.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25172 (GCVE-0-2020-25172)
Vulnerability from nvd – Published: 2020-11-06 16:09 – Updated: 2024-09-16 18:39
VLAI
EPSS
VEX
Title
B. Braun OnlineSuite
Summary
A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files.
Severity
No CVSS data available.
CWE
- CWE-23 - RELATIVE PATH TRAVERSAL CWE-23
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| B. Braun Melsungen AG | OnlineSuite |
Affected:
AP , ≤ 3.0
(custom)
|
Date Public
2020-10-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:10.164Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OnlineSuite",
"vendor": "B. Braun Melsungen AG",
"versions": [
{
"lessThanOrEqual": "3.0",
"status": "affected",
"version": "AP",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "RELATIVE PATH TRAVERSAL CWE-23",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-06T16:09:16.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
},
"title": "B. Braun OnlineSuite",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-10-22T15:00:00.000Z",
"ID": "CVE-2020-25172",
"STATE": "PUBLIC",
"TITLE": "B. Braun OnlineSuite"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OnlineSuite",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "AP",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "B. Braun Melsungen AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "RELATIVE PATH TRAVERSAL CWE-23"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
]
},
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25172",
"datePublished": "2020-11-06T16:09:16.397Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:39:05.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25170 (GCVE-0-2020-25170)
Vulnerability from nvd – Published: 2020-11-06 16:08 – Updated: 2024-09-17 00:56
VLAI
EPSS
VEX
Title
B. Braun OnlineSuite
Summary
An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export.
Severity
No CVSS data available.
CWE
- CWE-1236 - IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| B. Braun Melsungen AG | OnlineSuite |
Affected:
AP , ≤ 3.0
(custom)
|
Date Public
2020-10-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:09.606Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OnlineSuite",
"vendor": "B. Braun Melsungen AG",
"versions": [
{
"lessThanOrEqual": "3.0",
"status": "affected",
"version": "AP",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-06T16:08:07.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
},
"title": "B. Braun OnlineSuite",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-10-22T15:00:00.000Z",
"ID": "CVE-2020-25170",
"STATE": "PUBLIC",
"TITLE": "B. Braun OnlineSuite"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OnlineSuite",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "AP",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "B. Braun Melsungen AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
]
},
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25170",
"datePublished": "2020-11-06T16:08:07.525Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:56:57.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25172 (GCVE-0-2020-25172)
Vulnerability from cvelistv5 – Published: 2020-11-06 16:09 – Updated: 2024-09-16 18:39
VLAI
EPSS
VEX
Title
B. Braun OnlineSuite
Summary
A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files.
Severity
No CVSS data available.
CWE
- CWE-23 - RELATIVE PATH TRAVERSAL CWE-23
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| B. Braun Melsungen AG | OnlineSuite |
Affected:
AP , ≤ 3.0
(custom)
|
Date Public
2020-10-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:10.164Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OnlineSuite",
"vendor": "B. Braun Melsungen AG",
"versions": [
{
"lessThanOrEqual": "3.0",
"status": "affected",
"version": "AP",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "RELATIVE PATH TRAVERSAL CWE-23",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-06T16:09:16.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
},
"title": "B. Braun OnlineSuite",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-10-22T15:00:00.000Z",
"ID": "CVE-2020-25172",
"STATE": "PUBLIC",
"TITLE": "B. Braun OnlineSuite"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OnlineSuite",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "AP",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "B. Braun Melsungen AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "RELATIVE PATH TRAVERSAL CWE-23"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
]
},
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25172",
"datePublished": "2020-11-06T16:09:16.397Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:39:05.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25174 (GCVE-0-2020-25174)
Vulnerability from cvelistv5 – Published: 2020-11-06 16:08 – Updated: 2024-09-17 00:16
VLAI
EPSS
VEX
Title
B. Braun OnlineSuite
Summary
A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user.
Severity
No CVSS data available.
CWE
- CWE-427 - UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| B. Braun Melsungen AG | OnlineSuite |
Affected:
AP , ≤ 3.0
(custom)
|
Date Public
2020-10-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:10.187Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OnlineSuite",
"vendor": "B. Braun Melsungen AG",
"versions": [
{
"lessThanOrEqual": "3.0",
"status": "affected",
"version": "AP",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-06T16:08:41.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
},
"title": "B. Braun OnlineSuite",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-10-22T15:00:00.000Z",
"ID": "CVE-2020-25174",
"STATE": "PUBLIC",
"TITLE": "B. Braun OnlineSuite"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OnlineSuite",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "AP",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "B. Braun Melsungen AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
]
},
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25174",
"datePublished": "2020-11-06T16:08:41.727Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:16:15.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25170 (GCVE-0-2020-25170)
Vulnerability from cvelistv5 – Published: 2020-11-06 16:08 – Updated: 2024-09-17 00:56
VLAI
EPSS
VEX
Title
B. Braun OnlineSuite
Summary
An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export.
Severity
No CVSS data available.
CWE
- CWE-1236 - IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| B. Braun Melsungen AG | OnlineSuite |
Affected:
AP , ≤ 3.0
(custom)
|
Date Public
2020-10-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:09.606Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OnlineSuite",
"vendor": "B. Braun Melsungen AG",
"versions": [
{
"lessThanOrEqual": "3.0",
"status": "affected",
"version": "AP",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-06T16:08:07.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
],
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
},
"title": "B. Braun OnlineSuite",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-10-22T15:00:00.000Z",
"ID": "CVE-2020-25170",
"STATE": "PUBLIC",
"TITLE": "B. Braun OnlineSuite"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OnlineSuite",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "AP",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "B. Braun Melsungen AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01"
}
]
},
"source": {
"advisory": "ICSMA-20-296-01",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25170",
"datePublished": "2020-11-06T16:08:07.525Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:56:57.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}