CVE-2021-38392

A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.

CVSS v3 6.5 MEDIUM
CVSS v2.0 7.2 HIGH

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.3

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01	Third Party Advisory US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:16

Type	Values Removed	Values Added
CVSS	v2 : ~~7.2~~ v3 : ~~7.6~~	v2 : 7.2 v3 : 6.5
References	~~() https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01 - Third Party Advisory, US Government Resource~~	() https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01 - Third Party Advisory, US Government Resource

Information

Published : 2021-10-04 18:15

Updated : 2024-11-21 06:16

NVD link : CVE-2021-38392

Mitre link : CVE-2021-38392

CVE.ORG link : CVE-2021-38392

JSON object : View

Products Affected

bostonscientific

zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware
zoom_latitude_pogrammer\/recorder\/monitor_3120

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2021-38392", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.9}]}, "published": "2021-10-04T18:15:09.110", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world."}, {"lang": "es", "value": "Un atacante h\u00e1bil con acceso f\u00edsico al dispositivo afectado puede acceder a la unidad de disco duro del dispositivo para cambiar la regi\u00f3n de telemetr\u00eda y podr\u00eda usar esta configuraci\u00f3n para interrogar o programar un dispositivo implantable en cualquier regi\u00f3n del mundo"}], "lastModified": "2024-11-21T06:16:59.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bostonscientific:zoom_latitude_pogrammer\\/recorder\\/monitor_3120_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9D9AC21-FFE0-4A10-A236-04957BFCE2A3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bostonscientific:zoom_latitude_pogrammer\\/recorder\\/monitor_3120:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3CA3DB8D-C7B6-4276-BD8B-16C2EFDB5474"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}