← Zuruck zu CVEs
CVE-2023-0888
MEDIUM4.9
Beschreibung
An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks
CVE Details
CVSS v3.1 Bewertung4.9
SchweregradMEDIUM
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienHIGH
BenutzerinteraktionNONE
Veroffentlicht3/13/2023
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
bbraun:battery-pack_sp_with_wifibbraun:battery-pack_sp_with_wifi_firmware
Schwachen (CWE)
CWE-95CWE-94
Referenzen
https://www.bbraun.com/productsecurity(productsecurity@bbraun.com)
https://www.bbraunusa.com/productsecurity(productsecurity@bbraun.com)
https://www.bbraun.com/productsecurity(af854a3a-2127-422b-91ae-364da2661108)
https://www.bbraunusa.com/productsecurity(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.