by Kastro
Paper/Archive/CVE-2021-33885

CVE-2021-33885

mitre — An Insufficient Verification of Data Authenticity vulnerability in B.

EPSS 6%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 92.9.929 × 2018.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)10.0CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbbraunusa.com/en.htmrefmcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump