CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2020-16238 – B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
https://notcve.org/view.php?id=CVE-2020-16238
14 Apr 2022 — A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user. Una vulnerabilidad en el mecanismo de importación de configuraciones del B. Braun Melsungen AG SpaceCom Versiones L81/U61 y anteriores, y el módulo de Datos compactplus Versiones A10 y A11, permite a atacantes con acceso a l... • https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html • CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-25150 – B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
https://notcve.org/view.php?id=CVE-2020-25150
14 Apr 2022 — A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands. Un ataque de salto de ruta relativa en B. Braun Melsungen AG SpaceCom Versiones L81/U61 y anteriores, y el módulo de Datos compactplus Versiones A10 y A11, permite a atacantes con privilegios de usuar... • https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-33886
https://notcve.org/view.php?id=CVE-2021-33886
25 Aug 2021 — An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device. Una vulnerabilidad de saneamiento inapropiado de la entrada en B. Braun SpaceCom2 versiones anteriores a 012U000062, permite que un atacante remoto no autenticado obtenga acceso a la línea de comandos a n... • https://www.bbraunusa.com/en.htm • CWE-134: Use of Externally-Controlled Format String •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2021-33885
https://notcve.org/view.php?id=CVE-2021-33885
25 Aug 2021 — An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets. Una vulnerabilidad de Verificación Insuficiente de la Autenticidad de Datos en B. Braun SpaceCom2 versiones anteriores a 012U000062, permite a un atacante ... • https://www.bbraunusa.com/en.htm • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 1CVE-2021-33884
https://notcve.org/view.php?id=CVE-2021-33884
25 Aug 2021 — An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten. Una vulnerabilidad de Carga no Restringida de Archivos de Tipo Peligroso en B. Braun SpaceCom2 versiones anteriores a 012U000062, permite a atacantes remotos cargar cualquier archivo en el directorio /tmp del dispositivo mediante la API de la pági... • https://www.bbraunusa.com/en.htm • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2021-33883
https://notcve.org/view.php?id=CVE-2021-33883
25 Aug 2021 — A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration. Una vulnerabilidad de Transmisión en Texto sin Cifrar de Información Confidencial en B. Braun SpaceCom2 versiones anteriores a 012U000062, permite a un atacante remoto conseguir información confidencial al espiar el tráfico de red. • https://www.bbraunusa.com/en.htm • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2021-33882
https://notcve.org/view.php?id=CVE-2021-33882
25 Aug 2021 — A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands. Una vulnerabilidad de Falta de Autenticación para una Función Crítica en B. Braun SpaceCom2 versiones anteriores a 012U000062, permite a un atacante remoto reconfigurar el dispositivo desde una fuente desconocida debido a una falta de autenticación en los comandos ... • https://www.bbraunusa.com/en.htm • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25172 – B. Braun OnlineSuite
https://notcve.org/view.php?id=CVE-2020-25172
06 Nov 2020 — A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. Un ataque de salto de ruta relativa en la B. Braun OnlineSuite Versiones AP 3.0 y anteriores, permite a atacantes no autenticados cargar o descargar archivos arbitrarios • https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 • CWE-23: Relative Path Traversal •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25174 – B. Braun OnlineSuite
https://notcve.org/view.php?id=CVE-2020-25174
06 Nov 2020 — A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user. Una vulnerabilidad de secuestro DLL en la B. Braun OnlineSuite Versiones AP 3.0 y anteriores, permite a atacantes locales ejecutar código en el sistema como un usuario muy privilegiado • https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25170 – B. Braun OnlineSuite
https://notcve.org/view.php?id=CVE-2020-25170
06 Nov 2020 — An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export. Se presenta una vulnerabilidad de una Inyección de una Macro de Excel en la funcionalidad export en la B. Braun OnlineSuite versiones AP 3.0 y anteriores, por medio de múltiples campos de entrada que son manejados inapropiadamente en una exportación de un Excel • https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •