CVE-2021-33885

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.bbraunusa.com/en.htm	Broken Link
https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:bbraun:spacecom2:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:bbraun:infusomat_large_volume_pump_871305u:-:::::::*
	cpe:2.3:h:bbraun:spacestation_8713142u:-:::::::*

History

No history.

Information

Published : 2021-08-25 12:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-33885

Mitre link : CVE-2021-33885

CVE.ORG link : CVE-2021-33885

JSON object : View

Products Affected

bbraun

spacestation_8713142u
spacecom2
infusomat_large_volume_pump_871305u

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2021-33885", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.9}]}, "published": "2021-08-25T12:15:16.873", "references": [{"url": "https://www.bbraunusa.com/en.htm", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets."}, {"lang": "es", "value": "Una vulnerabilidad de Verificaci\u00f3n Insuficiente de la Autenticidad de Datos en B. Braun SpaceCom2 versiones anteriores a 012U000062, permite a un atacante remoto no autenticado enviar al dispositivo datos maliciosos que ser\u00e1n usados en lugar de los datos correctos. Esto da lugar a un acceso y ejecuci\u00f3n de comandos completos del sistema debido a una falta de firmas criptogr\u00e1ficas en una conjuntos de datos cr\u00edticos."}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bbraun:spacecom2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2D8F2AC-5506-405C-857A-EE060C209A89", "versionEndExcluding": "012u000062"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bbraun:infusomat_large_volume_pump_871305u:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A6C9420B-B015-4079-8B60-EF9C9C058193"}, {"criteria": "cpe:2.3:h:bbraun:spacestation_8713142u:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D6B64426-0B44-4B68-A80A-2BB6D04B3F88"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}