PT-2021-20352 · B. Braun · B. Braun Spacecom2

Published 2021-08-25 · Updated 2022-07-12 · CVE-2021-33885

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: B. Braun SpaceCom2 versions prior to 012U000062

Description: The issue is related to insufficient verification of data authenticity, allowing a remote unauthenticated attacker to send malicious data to the device. This malicious data is then used in place of the correct data, resulting in full system command access and execution due to the lack of cryptographic signatures on critical data sets.

Recommendations: For versions prior to 012U000062, update to version 012U000062 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-33885

Affected Products

B. Braun Spacecom2

References · 7

• 🔥 https://mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33885 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33885 · Vendor Advisory
• https://bbraunusa.com/en.htm · Note
• https://t.me/cvenotify/20508 · Telegram Post
• https://t.me/cibsecurity/27862 · Telegram Post
• https://t.me/cvenotify/20057 · Telegram Post