Vulnerability · Published Jan 8, 2021 · Assigned by icscert
CVE-2020-27260
Medium 5.3
In plain English
A medium-severity injection in BIGCOMPANYSOFT SOFTWARE PRODUCT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)0.4%top 61.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected parameters.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | BIGCOMPANYSOFT SOFTWARE PRODUCT | VC150 prior to Version 1.7.15 |
Weakness: CWE-74
References
- https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01 x_refsource_MISC