by Kastro
Paper/Archive/CVE-2021-43935

CVE-2021-43935

Hillrom Welch Allyn Q-Stress Cardiac Stress Testing System — ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.8.668 × 2013.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.

Affected

ProductAffectedFixed inSource
Welch Allyn Q-Stress Cardiac Stress Testing System6.0.0 – 6.3.1–CNA
Welch Allyn X-Scribe Cardiac Stress Testing System5.01 – 6.3.1–CNA
Welch Allyn Diagnostic Cardiology Suite2.1.0–CNA
Welch Allyn Vision Express6.1.0 – 6.4.0–CNA
Welch Allyn H-Scribe Holter Analysis System5.01 – 6.4.0–CNA
Welch Allyn R-Scribe Resting ECG System5.01 – 7.0.0–CNA
Welch Allyn Connex Cardio1.0.0 – 1.1.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcisa.gov/uscert/ics/advisories/icsma-21-343-01