Lucene search

IcscertCVE-2021-38392

HistoryOct 04, 2021 - 6:15 p.m.

CVE-2021-38392

2021-10-0418:15:09

CWE-284

icscert

web.nvd.nist.gov

security

access control

physical security

device security

implantable devices

telemetry

nvd

cve-2021-38392

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

27.4%

JSON

A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.

Affected configurations

Nvd

Node

bostonscientificzoom_latitude_pogrammer\/recorder\/monitor_3120_firmware

AND

bostonscientificzoom_latitude_pogrammer\/recorder\/monitor_3120Match-

VendorProductVersionCPE
bostonscientificzoom_latitude_pogrammer\/recorder\/monitor_3120_firmware*cpe:2.3:o:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware:*:*:*:*:*:*:*:*
bostonscientificzoom_latitude_pogrammer\/recorder\/monitor_3120-cpe:2.3:h:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bostonscientific	zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware	*	cpe:2.3:o:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware::::::::
bostonscientific	zoom_latitude_pogrammer\/recorder\/monitor_3120	-	cpe:2.3:h:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120:-:::::::*

CNA Affected

[
  {
    "product": "ZOOM LATITUDE",
    "vendor": "Boston Scientific",
    "versions": [
      {
        "status": "affected",
        "version": "Model 3120"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsma-21-273-01

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

27.4%

JSON

Related for CVE-2021-38392