PT-2021-11373 · Hamilton Medical Ag · T1-Ventillator

Published 2021-03-15 · Updated 2021-03-22 · CVE-2020-27290

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior

Description: An information disclosure issue in the ventilator allows attackers with physical access to the configuration interface's logs to obtain valid checksums for tampered configuration files. This could potentially be exploited by attackers to manipulate configuration files without being detected.

Recommendations: For versions 2.2.3 and prior, as a temporary workaround, consider restricting physical access to the configuration interface's logs until a patch is available. Additionally, monitor the configuration files for any signs of tampering and verify their integrity regularly. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-27290

Affected Products

T1-Ventillator

References · 5

• https://osv.dev/vulnerability/CVE-2020-27290 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27290 · Security Note
• https://t.me/cibsecurity/24934 · Telegram Post
• https://t.me/cvenotify/11383 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01 · Note