Vulnerability · Published Oct 4, 2021 · Assigned by icscert
CVE-2021-38394Missing Protection against Hardware Reverse Engineering Using Integrated Circuit Imaging Techniques for Boston Scientific Zoom Latitude
Medium 6.2
In plain English
A medium-severity security flaw in ZOOM LATITUDE from Boston Scientific. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.2%top 85.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Boston Scientific | ZOOM LATITUDE | Model 3120 |
Weakness: CWE-1278 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
References
- https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01 x_refsource_MISC