Vulnerability in Bbraun Datamodule Compactplus
CVE-2020-25166
An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.
EPSS: 0.005 (39.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L.
Affected products
- Bbraun Datamodule_compactplus — versions a10, a11
- Bbraun Spacecom
- B. Braun Melsungen Ag Battery Pack With Wi-fi — versions unspecified
- B. Braun Melsungen Ag Data Module Compactplus — versions A10, A11
- B. Braun Melsungen Ag Spacecom — versions unspecified
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (x_refsource_CONFIRM, US Government Resource, Third Party Advisory)
- ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Broken Link)
Frequently asked questions
- What is CVE-2020-25166?
- CVE-2020-25166 is a high-severity vulnerability in Bbraun Datamodule Compactplus, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.6/10. Published 2022-04-14.
- How severe is CVE-2020-25166?
- High severity. CVSS v3 base score is 7.6 out of 10.