PT-2023-16591 · B. Braun · B.Braun Battery Pack Sp

Tom Johnston · Published 2023-03-13 · Updated 2023-03-17 · CVE-2023-0888

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions B.Braun Battery Pack SP with WiFi web server versions L90/U70 and L92/U92

Description The issue is related to an improper neutralization of directives in dynamically evaluated code in the WiFi Battery embedded web server. This can be exploited by an authenticated user with access to the medical device WiFi network and the specific B.Braun Battery Pack SP with WiFi web server credentials to gain administrative access to the WiFi communication module. This access could be used as a vector to start further attacks.

Recommendations For versions L90/U70 and L92/U92, consider disabling access to the WiFi Battery embedded web server until a patch is available to prevent exploitation. Restrict access to the WiFi communication module to minimize the risk of gaining administrative access. Avoid using the WiFi web server credentials for the B.Braun Battery Pack SP until the issue is resolved.

Fix

Eval Injection

Code Injection

Weakness Enumeration

CWE-95

CWE-94

Related Identifiers

CVE-2023-0888

Affected Products

B.Braun Battery Pack Sp

References · 5

• https://osv.dev/vulnerability/CVE-2023-0888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0888 · Security Note
• https://bbraunusa.com/productsecurity · Note
• https://bbraun.com/productsecurity · Note
• https://t.me/cvenotify/46397 · Telegram Post