SB2021071604 - Multiple vulnerabilities in Ypsomed mylife

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Insufficiently protected credentials (CVE-ID: CVE-2021-27491)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficiently protected credentials. A remote attacker can disclose password hashes during the registration process.

2) Insufficiently protected credentials (CVE-ID: CVE-2021-27495)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected software reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint. A remote authenticated attacker can disclose sensitive information on the target system.

3) Not Using an Unpredictable IV with CBC Mode (CVE-ID: CVE-2021-27499)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs. A remote attacker can perform a man-in-the-middle attack to tamper with messages. 

4) Use of hard-coded credentials (CVE-ID: CVE-2021-27503)

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can perform a man-in-the-middle attack to tamper with messages.

Remediation

Install update from vendor's website.

References

• https://ics-cert.us-cert.gov/advisories/icsma-21-196-01