PT-2021-21540 · Swisslog · Swisslog Healthcare Nexus Panel

Published 2021-08-02 · Updated 2022-07-12 · CVE-2021-37160

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Swisslog Healthcare Nexus Panel versions prior to 7.2.5.7

Description A firmware validation issue was discovered in the HMI3 Control Panel. The issue arises from the lack of firmware validation, such as cryptographic signature validation, during a file upload for a firmware update.

Recommendations For versions prior to 7.2.5.7, update to version 7.2.5.7 or later to resolve the issue. As a temporary workaround, consider restricting file uploads for firmware updates until the update is applied.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-37160

Affected Products

Swisslog Healthcare Nexus Panel

References · 10

• https://swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37160-bulletin---no-firmware-update-validation.pdf?rev=c7f94647037c4007992e2e626d445561&hash=E89531490070A809FB74994018BA1248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37160 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37160 · Vendor Advisory
• https://swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=CVE%20Disclosures%20%20%20%20Vulnerability%20Name%20%2C%20%20CVE-2021-37164%20%204%20more%20rows%20 · Note
• https://t.me/true_secator/1966 · Telegram Post
• https://armis.com/PwnedPiper · Note
• https://swisslog-healthcare.com · Note
• https://t.me/cvenotify/18459 · Telegram Post
• https://t.me/cvenotify/18472 · Telegram Post
• https://t.me/cibsecurity/26673 · Telegram Post