Lucene search

[email protected]CVE-2020-25160

HistoryApr 14, 2022 - 9:15 p.m.

CVE-2020-25160

2022-04-1421:15:08

CWE-284

[email protected]

web.nvd.nist.gov

cve-2020-25160

b. braun melsungen ag

spacecom

data module compactplus

network security

6.8 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

6.3 Medium

AI Score

Confidence

High

4.6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

10.4%

JSON

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.

Affected configurations

NVD

Node

bbraundatamodule_compactplusMatch-

AND

bbraundatamodule_compactplusMatcha10

bbraundatamodule_compactplusMatcha11

Node

bbraunspacecomMatch-

AND

bbraunspacecomRange≤l81

CPENameOperatorVersion
bbraun:datamodule_compactplusbbraun datamodule compactpluseqa10
bbraun:datamodule_compactplusbbraun datamodule compactpluseqa11

CPE	Name	Operator	Version
bbraun:datamodule_compactplus	bbraun datamodule compactplus	eq	a10
bbraun:datamodule_compactplus	bbraun datamodule compactplus	eq	a11

CNA Affected

[
  {
    "product": "SpaceCom",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Battery pack with Wi-Fi",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Data module compactplus",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "status": "affected",
        "version": "A10"
      },
      {
        "status": "affected",
        "version": "A11"
      }
    ]
  }
]

References

www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

www.cisa.gov/uscert/ics/advisories/icsma-20-296-02

Social References

6.8 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

6.3 Medium

AI Score

Confidence

High

4.6 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

10.4%

JSON

Related for CVE-2020-25160

prion1 cvelist1 nvd1 ics1