bbraun 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには パス処理の欠陥、vendor risk open redirect、vendor risk cross-site scripting, and バッファオーバーフロー があり、vendor surface production workloads の利用場面で アプリケーションクラッシュ、vendor impact memory corruption, and vendor impact session compromise などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2023-0888 | An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communi | [email protected] | 4.9 | 0.65% | 2023-03-13 | 2024-11-21 |
| CVE-2020-25168 | Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enable attackers with command line access to access the device’s Wi-Fi module. | [email protected] | 3.3 | 0.05% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25166 | An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices. | [email protected] | 7.6 | 0.07% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25164 | A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to recover user credentials of the administrative interface. | [email protected] | 6.5 | 0.05% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25162 | A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote attackers to access sensitive information and escalate privileges. | [email protected] | 7.5 | 0.72% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25160 | Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration. | [email protected] | 6.8 | 0.04% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25158 | A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations. | [email protected] | 7.6 | 0.16% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25156 | Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root. | [email protected] | 7.2 | 0.29% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25154 | An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to redirect users to malicious websites. | [email protected] | 5.4 | 0.14% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25152 | A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges. | [email protected] | 6.5 | 0.43% | 2022-04-14 | 2024-11-21 |
| CVE-2020-25150 | A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands. | [email protected] | 7.6 | 0.58% | 2022-04-14 | 2024-11-21 |
| CVE-2020-16238 | A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user. | [email protected] | 6.7 | 0.04% | 2022-04-14 | 2024-11-21 |
| CVE-2021-33886 | An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device. | [email protected] | 8.1 | 1.32% | 2021-08-25 | 2024-11-21 |
| CVE-2021-33885 | An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets. | [email protected] | 10.0 | 6.92% | 2021-08-25 | 2024-11-21 |
| CVE-2021-33884 | An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten. | [email protected] | 6.5 | 0.45% | 2021-08-25 | 2024-11-21 |
| CVE-2021-33883 | A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration. | [email protected] | 5.9 | 0.41% | 2021-08-25 | 2024-11-21 |
| CVE-2021-33882 | A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands. | [email protected] | 6.8 | 0.20% | 2021-08-25 | 2024-11-21 |
| CVE-2020-25174 | A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user. | [email protected] | 7.8 | 0.05% | 2020-11-06 | 2024-11-21 |
| CVE-2020-25172 | A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. | [email protected] | 9.8 | 0.76% | 2020-11-06 | 2024-11-21 |
| CVE-2020-25170 | An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export. | [email protected] | 7.8 | 0.16% | 2020-11-06 | 2024-11-21 |