CVE-2020-25150

Summary

A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands.

Affected Software

Weaknesses

• CWE-23: CWE-23: Relative Path Traversal

Workarounds

As a general security measure, B. Braun recommends protecting the network with appropriate mechanisms:

Ensure the devices are not accessible directly from the Internet.
Use a firewall and isolate the medical devices from the business network. 

Please contact your local B. Braun organization to request further help. For more information please see the B. Braun Security Advisory. https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02
• https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02
• https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html

• ←Previous
• Next→