Lucene search

[email protected]CVE-2020-25166

HistoryApr 14, 2022 - 9:15 p.m.

CVE-2020-25166

2022-04-1421:15:08

CWE-347

[email protected]

web.nvd.nist.gov

cve-2020-25166

improper verification

cryptographic signature

firmware updates

b. braun melsungen ag

spacecom

data module compactplus

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:C/A:P

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.5%

JSON

An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.

Affected configurations

NVD

Node

bbraundatamodule_compactplusMatcha10

bbraundatamodule_compactplusMatcha11

AND

bbraundatamodule_compactplusMatch-

Node

bbraunspacecomMatch-

AND

bbraunspacecomRange≤l81

CPENameOperatorVersion
bbraun:datamodule_compactplusbbraun datamodule compactpluseqa10
bbraun:datamodule_compactplusbbraun datamodule compactpluseqa11

CPE	Name	Operator	Version
bbraun:datamodule_compactplus	bbraun datamodule compactplus	eq	a10
bbraun:datamodule_compactplus	bbraun datamodule compactplus	eq	a11

CNA Affected

[
  {
    "product": "SpaceCom",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Battery pack with Wi-Fi",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "lessThanOrEqual": "U61",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "L81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Data module compactplus",
    "vendor": "B. Braun Melsungen AG",
    "versions": [
      {
        "status": "affected",
        "version": "A10"
      },
      {
        "status": "affected",
        "version": "A11"
      }
    ]
  }
]

References

www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

www.cisa.gov/uscert/ics/advisories/icsma-20-296-02

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:C/A:P

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.5%

JSON

Related for CVE-2020-25166

prion1 cvelist1 nvd1 ics1