Lucene search

[email protected]CVE-2020-25164

HistoryApr 14, 2022 - 9:15 p.m.

CVE-2020-25164

2022-04-1421:15:08

CWE-759

[email protected]

web.nvd.nist.gov

cve-2020-25164

vulnerability

b. braun melsungen ag

spacecom

data module compactplus

user credentials

administrative interface

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to recover user credentials of the administrative interface.

Affected configurations

NVD

Node

bbraundatamodule_compactplusMatcha10

bbraundatamodule_compactplusMatcha11

AND

bbraundatamodule_compactplusMatch-

Node

bbraunspacecomRange≤l81

AND

bbraunspacecomMatch-

VendorProductVersionCPE
bbraundatamodule_compactplusa10cpe:/o:bbraun:datamodule_compactplus:a10:::
bbraundatamodule_compactplusa11cpe:/o:bbraun:datamodule_compactplus:a11:::

Vendor	Product	Version	CPE
bbraun	datamodule_compactplus	a10	cpe:/o:bbraun:datamodule_compactplus:a10:::
bbraun	datamodule_compactplus	a11	cpe:/o:bbraun:datamodule_compactplus:a11:::

CNA Affected

[
  {
    "product": "SpaceCom",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Battery pack with Wi-Fi",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Data module compactplus",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "status": "affected",
        "version": "A10"
      },
      {
        "status": "affected",
        "version": "A11"
      }
    ]
  }
]

References

www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

www.cisa.gov/uscert/ics/advisories/icsma-20-296-02

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

Related for CVE-2020-25164

cvelist1 prion1 nvd1 ics1