SB2021071604 - Multiple vulnerabilities in Ypsomed mylife

Description

This security bulletin contains information about 4 vulnerabilities.

1) Insufficiently protected credentials (CVE-ID: CVE-2021-27491)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficiently protected credentials. A remote attacker can disclose password hashes during the registration process.

2) Insufficiently protected credentials (CVE-ID: CVE-2021-27495)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected software reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint. A remote authenticated attacker can disclose sensitive information on the target system.

3) Not Using an Unpredictable IV with CBC Mode (CVE-ID: CVE-2021-27499)

CWE-ID: CWE-329 - Not Using an Unpredictable IV with CBC Mode

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs. A remote attacker can perform a man-in-the-middle attack to tamper with messages. 

4) Use of hard-coded credentials (CVE-ID: CVE-2021-27503)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can perform a man-in-the-middle attack to tamper with messages.

Remediation

Install update from vendor's website.

References

• https://ics-cert.us-cert.gov/advisories/icsma-21-196-01