Vulnerability identifier: #VU47915

Vulnerability risk: Low

CVSSv3.1: 4.3 [CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25166

CWE-ID: CWE-347

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
SpaceCom
Hardware solutions / Other hardware appliances
Data module compact plus
Hardware solutions / Other hardware appliances
Battery pack with Wi-Fi
Other software / Other software solutions

Vendor: B. Braun Melsungen AG

Description

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to an improper verification of the cryptographic signature of firmware updates. An attacker with physical access can generate valid firmware updates with arbitrary content that can be used to tamper with devices.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

SpaceCom: L81 - U61

Data module compact plus: A10 - A11

Battery pack with Wi-Fi: L81 - U61

---

External links
http://ics-cert.us-cert.gov/advisories/icsma-20-296-02
http://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/se...

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.