Auth bypass in Baxter Welch Allyn Connex Cardio
CVE-2021-43935
The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (63.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 63.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Baxter Welch Allyn Connex Cardio
- Baxter Welch Allyn Diagnostic Cardiology Suite — versions 2.1.0
- Baxter Welch Allyn Hscribe Holter Analysis System
- Baxter Welch Allyn Hscribe Holter Analysis System Firmware
- Baxter Welch Allyn Q-Stress Cardiac Stress Testing System
- Baxter Welch Allyn Q-Stress Cardiac Stress Testing System Firmware
- Baxter Welch Allyn Rscribe Resting Ecg System
- Baxter Welch Allyn Vision Express Holter Analysis System
- Baxter Welch Allyn Xscribe Cardiac Stress Testing System
- Baxter Welch Allyn Xscribe Cardiac Stress Testing System Firmware
Weakness classification (CWE)
References
- www.cisa.gov/uscert/ics/advisories/icsma-21-343-01 (US Government Resource, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2021-43935?
- CVE-2021-43935 is a high-severity vulnerability in Baxter Welch Allyn Connex Cardio, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 8.1/10. Published 2021-12-15.
- How severe is CVE-2021-43935?
- High severity. CVSS v3 base score is 8.1 out of 10.