PT-2021-21547 · Swisslog · Swisslog Healthcare Nexus Panel

Published 2021-08-02 · Updated 2023-08-08 · CVE-2021-37167

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Swisslog Healthcare Nexus Panel versions prior to 7.2.5.7

Description An insecure permissions issue was discovered in the HMI3 Control Panel of the Swisslog Healthcare Nexus Panel. This issue allows a user logged in using the default credentials to gain root access to the device, providing permissions for all of the device's functionality.

Recommendations For versions prior to 7.2.5.7, update to version 7.2.5.7 or later to resolve the issue. As a temporary workaround, consider changing the default credentials to prevent unauthorized access. Restrict access to the device until the update can be applied to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-37167

Affected Products

Swisslog Healthcare Nexus Panel

References · 10

• https://osv.dev/vulnerability/CVE-2021-37167 · Vendor Advisory
• https://swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37167-bulletin---privilege-escalation.pdf?rev=20c909e5f00048838620b52471f266fc&hash=F43731C7A882EEBB5CE28DFBC75933D3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37167 · Security Note
• https://t.me/cibsecurity/26675 · Telegram Post
• https://swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=CVE%20Disclosures%20%20%20%20Vulnerability%20Name%20%2C%20%20CVE-2021-37164%20%204%20more%20rows%20 · Note
• https://t.me/true_secator/1966 · Telegram Post
• https://t.me/cvenotify/18466 · Telegram Post
• https://armis.com/PwnedPiper · Note
• https://t.me/cvenotify/18453 · Telegram Post
• https://swisslog-healthcare.com · Note