PT-2023-16591 · B. Braun · B.Braun Battery Pack Sp

Tom Johnston · Publicado 2023-03-13 · Atualizado 2023-03-17 · CVE-2023-0888

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions B.Braun Battery Pack SP with WiFi web server versions L90/U70 and L92/U92

Description The issue is related to an improper neutralization of directives in dynamically evaluated code in the WiFi Battery embedded web server. This can be exploited by an authenticated user with access to the medical device WiFi network and the specific B.Braun Battery Pack SP with WiFi web server credentials to gain administrative access to the WiFi communication module. This access could be used as a vector to start further attacks.

Recommendations For versions L90/U70 and L92/U92, consider disabling access to the WiFi Battery embedded web server until a patch is available to prevent exploitation. Restrict access to the WiFi communication module to minimize the risk of gaining administrative access. Avoid using the WiFi web server credentials for the B.Braun Battery Pack SP until the issue is resolved.

Correção

Eval Injection

Code Injection

Enumeração de Fraquezas

CWE-95

CWE-94

Identificadores relacionados

CVE-2023-0888

Produtos afetados

B.Braun Battery Pack Sp

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-0888 · Aviso do Fabricante
• https://bbraunusa.com/productsecurity · Nota
• https://bbraun.com/productsecurity · Nota
• https://t.me/cvenotify/46397 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0888 · Nota de Segurança