Lucene search

IcscertCVE-2020-25160

HistoryApr 14, 2022 - 9:15 p.m.

CVE-2020-25160

2022-04-1421:15:08

CWE-284

icscert

web.nvd.nist.gov

cve-2020-25160

b. braun melsungen ag

spacecom

data module compactplus

network security

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

AI Score

6.3

Confidence

High

EPSS

Percentile

10.4%

JSON

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.

Affected configurations

Nvd

Node

bbraundatamodule_compactplusMatch-

AND

bbraundatamodule_compactplusMatcha10

bbraundatamodule_compactplusMatcha11

Node

bbraunspacecomMatch-

AND

bbraunspacecomRange≤l81

VendorProductVersionCPE
bbraundatamodule_compactplus-cpe:2.3:h:bbraun:datamodule_compactplus:-:*:*:*:*:*:*:*
bbraundatamodule_compactplusa10cpe:2.3:o:bbraun:datamodule_compactplus:a10:*:*:*:*:*:*:*
bbraundatamodule_compactplusa11cpe:2.3:o:bbraun:datamodule_compactplus:a11:*:*:*:*:*:*:*
bbraunspacecom-cpe:2.3:h:bbraun:spacecom:-:*:*:*:*:*:*:*
bbraunspacecom*cpe:2.3:o:bbraun:spacecom:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bbraun	datamodule_compactplus	-	cpe:2.3:h:bbraun:datamodule_compactplus:-:::::::*
bbraun	datamodule_compactplus	a10	cpe:2.3:o:bbraun:datamodule_compactplus:a10:::::::*
bbraun	datamodule_compactplus	a11	cpe:2.3:o:bbraun:datamodule_compactplus:a11:::::::*
bbraun	spacecom	-	cpe:2.3:h:bbraun:spacecom:-:::::::*
bbraun	spacecom	*	cpe:2.3:o:bbraun:spacecom::::::::

CNA Affected

[
  {
    "product": "SpaceCom",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Battery pack with Wi-Fi",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Data module compactplus",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "status": "affected",
        "version": "A10"
      },
      {
        "status": "affected",
        "version": "A11"
      }
    ]
  }
]

References

www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

www.cisa.gov/uscert/ics/advisories/icsma-20-296-02

Social References

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

AI Score

6.3

Confidence

High

EPSS

Percentile

10.4%

JSON

Related for CVE-2020-25160