CVE-2020-16238 : Security Advisory and Response

A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user.

Understanding CVE-2020-16238

This CVE involves vulnerabilities in B. Braun Melsungen AG's SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus products.

What is CVE-2020-16238?

CVE-2020-16238 is a vulnerability that enables attackers with command line access to escalate privileges to the root user in certain B. Braun Melsungen AG products.

The Impact of CVE-2020-16238

The vulnerability has a CVSS base score of 6.7, with high impacts on confidentiality, integrity, and availability. Attackers can exploit this issue to gain root user privileges.

Technical Details of CVE-2020-16238

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability lies in the configuration import mechanism of SpaceCom Version L81/U61, and Data module compactplus Versions A10 and A11, allowing privilege escalation to the root user.

Affected Systems and Versions

SpaceCom: Versions L81/U61 and earlier
Battery Pack with Wi-Fi: Versions L81/U61 and earlier
Data module compactplus: Versions A10 and A11

Exploitation Mechanism

Attackers with command line access to the Linux system can exploit this vulnerability to elevate their privileges to root.

Mitigation and Prevention

Learn how to mitigate and prevent the CVE-2020-16238 vulnerability.

Immediate Steps to Take

Apply updates recommended by B. Braun Melsungen AG for affected products.
Protect the network by ensuring devices are not directly accessible from the Internet.
Use a firewall to isolate medical devices from the business network.

Long-Term Security Practices

Regularly update and patch all software and firmware.
Conduct security assessments and audits periodically.

Patching and Updates

SpaceCom: Version U62 or later (United States), L82 or later (outside the United States)
Battery Pack SP with Wi-Fi: Version U62 or later (United States), L82 or later (outside the United States)
Data module compactplus: Version A12 or later