CVE-2023-0888

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0888
An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.bbraun.com/productsecurity Product
https://www.bbraunusa.com/productsecurity Product
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:global:*:*:*
cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:us:*:*:*
cpe:2.3:h:bbraun:battery-pack_sp_with_wifi:-:*:*:*:*:*:*:*
History

07 Nov 2023, 04:01

Type Values Removed Values Added
Summary An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks

17 Mar 2023, 14:39

Type Values Removed Values Added
CPE cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:global:*:*:*
cpe:2.3:h:bbraun:battery-pack_sp_with_wifi:-:*:*:*:*:*:*:*
cpe:2.3:o:bbraun:battery-pack_sp_with_wifi_firmware:*:*:*:*:us:*:*:*
First Time Bbraun battery-pack Sp With Wifi
Bbraun
Bbraun battery-pack Sp With Wifi Firmware
CWE CWE-94
References (MISC) https://www.bbraun.com/productsecurity - (MISC) https://www.bbraun.com/productsecurity - Product
References (MISC) https://www.bbraunusa.com/productsecurity - (MISC) https://www.bbraunusa.com/productsecurity - Product
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2

13 Mar 2023, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-13 09:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-0888

Mitre link : CVE-2023-0888

CVE.ORG link : CVE-2023-0888

JSON object : View

Products Affected

bbraun

  • battery-pack_sp_with_wifi
  • battery-pack_sp_with_wifi_firmware
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')