PT-2021-21543 · Swisslog · Swisslog Healthcare Nexus

Published 2021-08-02 · Updated 2021-08-10 · CVE-2021-37163

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Swisslog Healthcare Nexus versions prior to 7.2.5.7

Description An insecure permissions issue was discovered in the HMI3 Control Panel of Swisslog Healthcare Nexus. The device has two user accounts with hardcoded passwords.

Recommendations For versions prior to 7.2.5.7, update to version 7.2.5.7 or later to resolve the issue. As a temporary workaround, consider changing the hardcoded passwords of the two user accounts to unique and secure passwords until a patch is available. Restrict access to the HMI3 Control Panel to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-37163

Affected Products

Swisslog Healthcare Nexus

References · 10

• https://osv.dev/vulnerability/CVE-2021-37163 · Vendor Advisory
• https://swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37163-bulletin---default-credentials-for-the-telnet-server.pdf?rev=da64c389a475494985b9fd2c2c508542&hash=466A7109AF08EBFF3756B2C25968ED5E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37163 · Security Note
• https://t.me/cvenotify/18469 · Telegram Post
• https://t.me/cibsecurity/26680 · Telegram Post
• https://t.me/true_secator/1966 · Telegram Post
• https://swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=CVE%20Disclosures%20%20%20%20Vulnerability%20Name%20%2C%20%20CVE-2021-37164%20%204%20more%20rows%20 · Note
• https://t.me/cvenotify/18456 · Telegram Post
• https://armis.com/PwnedPiper · Note
• https://swisslog-healthcare.com · Note