Sign-up

ID

VAR-202108-1893


CVE

CVE-2021-37163


TITLE

HMI3 Control Panel trust management issue vulnerability

Trust: 1.2

sources: CNVD: CNVD-2021-94955 // CNNVD: CNNVD-202108-086

DESCRIPTION

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software 7.2.5.7. The device has two user accounts with passwords that are hardcoded. Swisslog Healthcare Nexus Panel is a medical device of Swisslog Healthcare. No detailed vulnerability details are currently provided. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.07

sources: NVD: CVE-2021-37163 // CNVD: CNVD-2021-94955 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-37163

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-94955

AFFECTED PRODUCTS

vendor:swisslog healthcaremodel:hmi-3 control panelscope:ltversion:7.2.5.7

Trust: 1.0

vendor:swisslogmodel:healthcare nexus control panelscope:ltversion:7.2.5.7

Trust: 0.6

sources: CNVD: CNVD-2021-94955 // NVD: CVE-2021-37163

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-37163
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2021-94955
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202108-086
value: CRITICAL

Trust: 0.6

VULMON: CVE-2021-37163
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-37163
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2021-94955
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-37163
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2021-94955 // VULMON: CVE-2021-37163 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-086 // NVD: CVE-2021-37163

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.0

sources: NVD: CVE-2021-37163

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-086

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:Patch for HMI3 Control Panel trust management issue vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/303246

Trust: 0.6

title:HMI3 Control Panel Repair measures for trust management problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=159509

Trust: 0.6

sources: CNVD: CNVD-2021-94955 // CNNVD: CNNVD-202108-086

EXTERNAL IDS

db:NVDid:CVE-2021-37163

Trust: 2.3

db:ICS CERTid:ICSMA-21-215-01

Trust: 1.2

db:CNVDid:CNVD-2021-94955

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:AUSCERTid:ESB-2021.2625

Trust: 0.6

db:CS-HELPid:SB2021080306

Trust: 0.6

db:CNNVDid:CNNVD-202108-086

Trust: 0.6

db:VULMONid:CVE-2021-37163

Trust: 0.1

sources: CNVD: CNVD-2021-94955 // VULMON: CVE-2021-37163 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-086 // NVD: CVE-2021-37163

REFERENCES

url:https://www.armis.com/pwnedpiper

Trust: 1.7

url:https://www.swisslog-healthcare.com

Trust: 1.7

url:https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37163-bulletin---default-credentials-for-the-telnet-server.pdf?rev=da64c389a475494985b9fd2c2c508542&hash=466a7109af08ebff3756b2c25968ed5e

Trust: 1.7

url:https://us-cert.cisa.gov/ics/advisories/icsma-21-215-01

Trust: 1.2

url:https://www.swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=cve%20disclosures%20%20%20%20vulnerability%20name%20%2c%20%20cve-2021-37164%20%204%20more%20rows%20

Trust: 1.0

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=cve%20disclosures%20%20%20%20vulnerability%20name%20

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021080306

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2625

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/798.html

Trust: 0.1

url:https://www.swisslog-healthcare.com/en-us/customer-care/security-information/cve-disclosures#:~:text=cve%20disclosures%20%20%20%20vulnerability%20name%20,%20%20cve-2021-37164%20%204%20more%20rows%20

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-94955 // VULMON: CVE-2021-37163 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-086 // NVD: CVE-2021-37163

CREDITS

Barak Hadad and Ben Seri from Armis reported these vulnerabilities to Swisslog.

Trust: 0.6

sources: CNNVD: CNNVD-202108-086

SOURCES

db:CNVDid:CNVD-2021-94955
db:VULMONid:CVE-2021-37163
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202108-086
db:NVDid:CVE-2021-37163

LAST UPDATE DATE

2024-08-14T13:18:55.844000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-94955date:2021-12-07T00:00:00
db:VULMONid:CVE-2021-37163date:2021-08-10T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202108-086date:2021-08-17T00:00:00
db:NVDid:CVE-2021-37163date:2023-11-07T03:36:55.333

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-94955date:2021-08-16T00:00:00
db:VULMONid:CVE-2021-37163date:2021-08-02T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202108-086date:2021-08-02T00:00:00
db:NVDid:CVE-2021-37163date:2021-08-02T13:15:07.800