PT-2021-11366 · Hamilton Medical Ag · T1-Ventillator

Dr. Oliver Matula + 3 · Published 2021-03-15 · Updated 2021-03-22 · CVE-2020-27282

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior

Description: The issue is related to an XML validation vulnerability in the ventilator, allowing privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files.

Recommendations: For Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior, consider restricting physical access to the device to prevent exploitation of the XML validation vulnerability until a patch is available. As a temporary workaround, consider disabling the upload of configuration files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-112

Related Identifiers

CVE-2020-27282

Affected Products

T1-Ventillator

References · 5

• https://osv.dev/vulnerability/CVE-2020-27282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27282 · Security Note
• https://t.me/cvenotify/11382 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01 · Note
• https://t.me/cibsecurity/24931 · Telegram Post