fkie_nvd - fkie_cve-2023-0888

FKIE_CVE-2023-0888

Vulnerability from fkie_nvd - Published: 2023-03-13 09:15 - Updated: 2024-11-21 07:38

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks

References

URL	Tags
productsecurity@bbraun.com	https://www.bbraun.com/productsecurity	Product
productsecurity@bbraun.com	https://www.bbraunusa.com/productsecurity	Product
af854a3a-2127-422b-91ae-364da2661108	https://www.bbraun.com/productsecurity	Product
af854a3a-2127-422b-91ae-364da2661108	https://www.bbraunusa.com/productsecurity	Product

Impacted products

Vendor	Product	Version
bbraun	battery-pack_sp_with_wifi_firmware	*
bbraun	battery-pack_sp_with_wifi_firmware	*
bbraun	battery-pack_sp_with_wifi	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:global:*:*:*",
              "matchCriteriaId": "8B1E3BFE-FA53-455B-8123-5832752563D6",
              "versionEndIncluding": "053l000092",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:us:*:*:*",
              "matchCriteriaId": "52E526B0-39B2-42DB-B00C-5FC80351A082",
              "versionEndIncluding": "054u000092",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bbraun:battery-pack_sp_with_wifi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62C8A903-575E-42A3-8980-ABE788309AD4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\n\n"
    }
  ],
  "id": "CVE-2023-0888",
  "lastModified": "2024-11-21T07:38:02.240",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6,
        "source": "productsecurity@bbraun.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-03-13T09:15:10.013",
  "references": [
    {
      "source": "productsecurity@bbraun.com",
      "tags": [
        "Product"
      ],
      "url": "https://www.bbraun.com/productsecurity"
    },
    {
      "source": "productsecurity@bbraun.com",
      "tags": [
        "Product"
      ],
      "url": "https://www.bbraunusa.com/productsecurity"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.bbraun.com/productsecurity"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.bbraunusa.com/productsecurity"
    }
  ],
  "sourceIdentifier": "productsecurity@bbraun.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ],
      "source": "productsecurity@bbraun.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-0888 (GCVE-0-2023-0888)

Vulnerability from cvelistv5 – Published: 2023-03-13 08:14 – Updated: 2025-02-27 18:17

Summary

Severity ?

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-95 - Eval injection

Assigner

B.Braun

References

URL

Tags

	https://www.bbraun.com/productsecurity
	https://www.bbraunusa.com/productsecurity

Impacted products

	Vendor	Product	Version
	B. Braun	Space Battery Pack SP with Wi-Fi	Affected: 0 , ≤ 053L000092 (custom) Affected: 0 , ≤ 054U000092 (custom)

Credits

Tom Johnston

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.770Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bbraun.com/productsecurity"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bbraunusa.com/productsecurity"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0888",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:17:34.759625Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:17:42.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Space Battery Pack SP with Wi-Fi",
          "vendor": "B. Braun ",
          "versions": [
            {
              "lessThanOrEqual": "053L000092",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "054U000092",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tom Johnston"
        }
      ],
      "datePublic": "2023-03-15T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Eval injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-13T08:14:32.358Z",
        "orgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d",
        "shortName": "B.Braun"
      },
      "references": [
        {
          "url": "https://www.bbraun.com/productsecurity"
        },
        {
          "url": "https://www.bbraunusa.com/productsecurity"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to version L93/U93 or newer solves the issue."
            }
          ],
          "value": "Update to version L93/U93 or newer solves the issue."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi  ",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use secure credentials and keep them secret.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecure your network to prevent outside access to medical devices.\u003c/span\u003e"
            }
          ],
          "value": "Use secure credentials and keep them secret.\u00a0Secure your network to prevent outside access to medical devices."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d",
    "assignerShortName": "B.Braun",
    "cveId": "CVE-2023-0888",
    "datePublished": "2023-03-13T08:14:32.358Z",
    "dateReserved": "2023-02-17T09:22:21.832Z",
    "dateUpdated": "2025-02-27T18:17:42.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2023-0888

CVE-2023-0888 (GCVE-0-2023-0888)

Tags

Sightings

Nomenclature