PT-2021-20351

Name of the Vulnerable Software and Affected Versions: B. Braun SpaceCom2 versions prior to 012U000062 Description: The issue allows remote attackers to upload any files to the /tmp directory of the device through the webpage API, potentially resulting in critical files being overwritten...

PT-2021-20352

Name of the Vulnerable Software and Affected Versions: B. Braun SpaceCom2 versions prior to 012U000062 Description: The issue is related to insufficient verification of data authenticity, allowing a remote unauthenticated attacker to send malicious data to the device. This malicious data is then...

PT-2021-20353

Name of the Vulnerable Software and Affected Versions: B. Braun SpaceCom2 versions prior to 012U000062 Description: An improper sanitization of input issue in B. Braun SpaceCom2 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straig...

CVE-2021-33882: Missing Authentication for Critical Function

A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands...

CVE-2021-33883: Cleartext Transmission of Sensitive Information

A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration...

CVE-2021-33884: Unrestricted Upload of File with Dangerous Type

An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten...

CVE-2021-33885: Improper Verification of Cryptographic Signature

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of...

CVE-2021-33886: Use of Externally-Controlled Format String

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...