PT-2021-11350 · Innokas Yhtymä Oy · Vital Signs Monitor Vc150

Birk Kauer + 3 · Published 2021-01-08 · Updated 2021-01-14 · CVE-2020-27260

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Innokas Yhtymä Oy Vital Signs Monitor VC150 versions prior to 1.7.15

Description: The issue allows physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected parameters. This is related to HL7 v2.x injection vulnerabilities in the affected products.

Recommendations: For versions prior to 1.7.15, update to version 1.7.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the barcode reader or limiting the ability to inject HL7 v2.x segments into messages until a patch is applied.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-27260

Affected Products

Vital Signs Monitor Vc150

References · 4

• https://osv.dev/vulnerability/CVE-2020-27260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27260 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01 · Note
• https://t.me/cibsecurity/21829 · Telegram Post