PT-2021-17481 · Ypsomed · Ypsomed Mylife Cloud+1

Dr. Oliver Matula + 3 · Published 2021-08-02 · Updated 2023-06-30 · CVE-2021-27499

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ypsomed mylife Cloud versions prior to 1.7.2 Ypsomed mylife App versions prior to 1.7.5

Description The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs, which allows man-in-the-middle attackers to tamper with messages.

Recommendations For Ypsomed mylife Cloud versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. For Ypsomed mylife App versions prior to 1.7.5, update to version 1.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data exchanged between the Ypsomed mylife App and mylife Cloud until the update is applied.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-329

CWE-330

Related Identifiers

CVE-2021-27499

Affected Products

Ypsomed Mylife App

Ypsomed Mylife Cloud

References · 5

• https://osv.dev/vulnerability/CVE-2021-27499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27499 · Security Note
• https://t.me/cvenotify/53416 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsma-21-196-01 · Note
• https://t.me/cibsecurity/26715 · Telegram Post