Lucene search

[email protected]NVD:CVE-2020-25160

HistoryApr 14, 2022 - 9:15 p.m.

CVE-2020-25160

2022-04-1421:15:08

CWE-284

[email protected]

web.nvd.nist.gov

improper access controls

b. braun melsungen ag

spacecom

data compactplus

network configuration

extraction

tampering

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS

Percentile

10.4%

JSON

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.

Affected configurations

Nvd

Node

bbraundatamodule_compactplusMatch-

AND

bbraundatamodule_compactplusMatcha10

bbraundatamodule_compactplusMatcha11

Node

bbraunspacecomMatch-

AND

bbraunspacecomRange≤l81

VendorProductVersionCPE
bbraundatamodule_compactplus-cpe:2.3:h:bbraun:datamodule_compactplus:-:*:*:*:*:*:*:*
bbraundatamodule_compactplusa10cpe:2.3:o:bbraun:datamodule_compactplus:a10:*:*:*:*:*:*:*
bbraundatamodule_compactplusa11cpe:2.3:o:bbraun:datamodule_compactplus:a11:*:*:*:*:*:*:*
bbraunspacecom-cpe:2.3:h:bbraun:spacecom:-:*:*:*:*:*:*:*
bbraunspacecom*cpe:2.3:o:bbraun:spacecom:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bbraun	datamodule_compactplus	-	cpe:2.3:h:bbraun:datamodule_compactplus:-:::::::*
bbraun	datamodule_compactplus	a10	cpe:2.3:o:bbraun:datamodule_compactplus:a10:::::::*
bbraun	datamodule_compactplus	a11	cpe:2.3:o:bbraun:datamodule_compactplus:a11:::::::*
bbraun	spacecom	-	cpe:2.3:h:bbraun:spacecom:-:::::::*
bbraun	spacecom	*	cpe:2.3:o:bbraun:spacecom::::::::

References

www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

www.cisa.gov/uscert/ics/advisories/icsma-20-296-02

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS

Percentile

10.4%

JSON

Related for NVD:CVE-2020-25160

prion1 cvelist1 cve1 ics1