Vulnerability · Published Apr 14, 2022 · Assigned by icscert
CVE-2020-25166B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
High 7.6
In plain English
A high-severity security flaw in Battery pack with Wi-Fi from B. Braun Melsungen AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| B. Braun Melsungen AG | SpaceCom | unspecified – through U61unspecified – through L81 |
| B. Braun Melsungen AG | Battery pack with Wi-Fi | unspecified – through U61unspecified – through L81 |
| B. Braun Melsungen AG | Data module compactplus | A10A11 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L