Auth bypass in Baxter Welch Allyn Connex Cardio
CVE-2021-43935
The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.
EPSS: 0.011 (61.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Baxter Welch_allyn_connex_cardio
- Baxter Welch_allyn_diagnostic_cardiology_suite — versions 2.1.0
- Baxter Welch_allyn_hscribe_holter_analysis_system
- Baxter Welch_allyn_hscribe_holter_analysis_system_firmware
- Baxter Welch_allyn_q-stress_cardiac_stress_testing_system
- Baxter Welch_allyn_q-stress_cardiac_stress_testing_system_firmware
- Baxter Welch_allyn_rscribe_resting_ecg_system
- Baxter Welch_allyn_vision_express_holter_analysis_system
- Baxter Welch_allyn_xscribe_cardiac_stress_testing_system
- Baxter Welch_allyn_xscribe_cardiac_stress_testing_system_firmware
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)
Frequently asked questions
- What is CVE-2021-43935?
- CVE-2021-43935 is a high-severity vulnerability in Baxter Welch Allyn Connex Cardio, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 8.1/10. Published 2021-12-15.
- How severe is CVE-2021-43935?
- High severity. CVSS v3 base score is 8.1 out of 10.