PT-2021-17483 · Ypsomed · Ypsomed Mylife Cloud+1

Published 2021-08-02 · Updated 2021-08-11 · CVE-2021-27503

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ypsomed mylife Cloud versions prior to 1.7.2 Ypsomed mylife App versions prior to 1.7.5

Description The application encrypts communication between the Ypsomed mylife App and mylife Cloud credentials based on hard-coded secrets. This allows man-in-the-middle attackers to tamper with messages.

Recommendations For Ypsomed mylife Cloud versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. For Ypsomed mylife App versions prior to 1.7.5, update to version 1.7.5 or later to resolve the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-27503

Affected Products

Ypsomed Mylife App

Ypsomed Mylife Cloud

References · 4

• https://osv.dev/vulnerability/CVE-2021-27503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27503 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsma-21-196-01 · Note
• https://t.me/cibsecurity/26710 · Telegram Post