CVE-2023-0888 (GCVE-0-2023-0888)
Vulnerability from cvelistv5 – Published: 2023-03-13 08:14 – Updated: 2025-02-27 18:17
VLAI?
Summary
An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks
Severity ?
4.9 (Medium)
CWE
- CWE-95 - Eval injection
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B. Braun | Space Battery Pack SP with Wi-Fi |
Affected:
0 , ≤ 053L000092
(custom)
Affected: 0 , ≤ 054U000092 (custom) |
Credits
Tom Johnston
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:24:34.770Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.bbraun.com/productsecurity"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.bbraunusa.com/productsecurity"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-0888",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-27T18:17:34.759625Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T18:17:42.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Space Battery Pack SP with Wi-Fi",
"vendor": "B. Braun ",
"versions": [
{
"lessThanOrEqual": "053L000092",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "054U000092",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Tom Johnston"
}
],
"datePublic": "2023-03-15T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95 Eval injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-13T08:14:32.358Z",
"orgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d",
"shortName": "B.Braun"
},
"references": [
{
"url": "https://www.bbraun.com/productsecurity"
},
{
"url": "https://www.bbraunusa.com/productsecurity"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version L93/U93 or newer solves the issue."
}
],
"value": "Update to version L93/U93 or newer solves the issue."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi ",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use secure credentials and keep them secret.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecure your network to prevent outside access to medical devices.\u003c/span\u003e"
}
],
"value": "Use secure credentials and keep them secret.\u00a0Secure your network to prevent outside access to medical devices."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d",
"assignerShortName": "B.Braun",
"cveId": "CVE-2023-0888",
"datePublished": "2023-03-13T08:14:32.358Z",
"dateReserved": "2023-02-17T09:22:21.832Z",
"dateUpdated": "2025-02-27T18:17:42.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:global:*:*:*\", \"versionEndIncluding\": \"053l000092\", \"matchCriteriaId\": \"8B1E3BFE-FA53-455B-8123-5832752563D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:us:*:*:*\", \"versionEndIncluding\": \"054u000092\", \"matchCriteriaId\": \"52E526B0-39B2-42DB-B00C-5FC80351A082\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:bbraun:battery-pack_sp_with_wifi:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"62C8A903-575E-42A3-8980-ABE788309AD4\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\\n\\n\"}]",
"id": "CVE-2023-0888",
"lastModified": "2024-11-21T07:38:02.240",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"productsecurity@bbraun.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 4.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}]}",
"published": "2023-03-13T09:15:10.013",
"references": "[{\"url\": \"https://www.bbraun.com/productsecurity\", \"source\": \"productsecurity@bbraun.com\", \"tags\": [\"Product\"]}, {\"url\": \"https://www.bbraunusa.com/productsecurity\", \"source\": \"productsecurity@bbraun.com\", \"tags\": [\"Product\"]}, {\"url\": \"https://www.bbraun.com/productsecurity\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Product\"]}, {\"url\": \"https://www.bbraunusa.com/productsecurity\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Product\"]}]",
"sourceIdentifier": "productsecurity@bbraun.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"productsecurity@bbraun.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-95\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-94\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-0888\",\"sourceIdentifier\":\"productsecurity@bbraun.com\",\"published\":\"2023-03-13T09:15:10.013\",\"lastModified\":\"2024-11-21T07:38:02.240\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\\n\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"productsecurity@bbraun.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"productsecurity@bbraun.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-95\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:global:*:*:*\",\"versionEndIncluding\":\"053l000092\",\"matchCriteriaId\":\"8B1E3BFE-FA53-455B-8123-5832752563D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:us:*:*:*\",\"versionEndIncluding\":\"054u000092\",\"matchCriteriaId\":\"52E526B0-39B2-42DB-B00C-5FC80351A082\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:bbraun:battery-pack_sp_with_wifi:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62C8A903-575E-42A3-8980-ABE788309AD4\"}]}]}],\"references\":[{\"url\":\"https://www.bbraun.com/productsecurity\",\"source\":\"productsecurity@bbraun.com\",\"tags\":[\"Product\"]},{\"url\":\"https://www.bbraunusa.com/productsecurity\",\"source\":\"productsecurity@bbraun.com\",\"tags\":[\"Product\"]},{\"url\":\"https://www.bbraun.com/productsecurity\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://www.bbraunusa.com/productsecurity\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Space Battery Pack SP with Wi-Fi\", \"vendor\": \"B. Braun \", \"versions\": [{\"lessThanOrEqual\": \"053L000092\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}, {\"lessThanOrEqual\": \"054U000092\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Tom Johnston\"}], \"datePublic\": \"2023-03-15T07:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\u003cbr\u003e\u003cbr\u003e\"}], \"value\": \"An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\\n\\n\"}], \"impacts\": [{\"capecId\": \"CAPEC-233\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-233 Privilege Escalation\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 4.9, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-95\", \"description\": \"CWE-95 Eval injection\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"653264ec-f98b-4e8f-b8b4-540a01b7657d\", \"shortName\": \"B.Braun\", \"dateUpdated\": \"2023-03-13T08:14:32.358Z\"}, \"references\": [{\"url\": \"https://www.bbraun.com/productsecurity\"}, {\"url\": \"https://www.bbraunusa.com/productsecurity\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Update to version L93/U93 or newer solves the issue.\"}], \"value\": \"Update to version L93/U93 or newer solves the issue.\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"title\": \"Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi \", \"workarounds\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Use secure credentials and keep them secret.\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eSecure your network to prevent outside access to medical devices.\u003c/span\u003e\"}], \"value\": \"Use secure credentials and keep them secret.\\u00a0Secure your network to prevent outside access to medical devices.\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T05:24:34.770Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.bbraun.com/productsecurity\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.bbraunusa.com/productsecurity\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-0888\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:17:34.759625Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:17:38.539Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2023-0888\", \"assignerOrgId\": \"653264ec-f98b-4e8f-b8b4-540a01b7657d\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"B.Braun\", \"dateReserved\": \"2023-02-17T09:22:21.832Z\", \"datePublished\": \"2023-03-13T08:14:32.358Z\", \"dateUpdated\": \"2025-02-27T18:17:42.996Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…