CVE-2020-25152 : Vulnerability Insights and Analysis

A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges.

Understanding CVE-2020-25152

This CVE involves vulnerabilities in B. Braun Melsungen AG's SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus.

What is CVE-2020-25152?

CVE-2020-25152 is a session fixation vulnerability in B. Braun Melsungen AG's SpaceCom administrative interface and Data module compactplus, enabling attackers to take over web sessions and elevate their privileges.

The Impact of CVE-2020-25152

The vulnerability poses a medium severity risk with a CVSS base score of 6.5, allowing attackers to compromise confidentiality.

Technical Details of CVE-2020-25152

This section provides detailed technical information about the CVE.

Vulnerability Description

The vulnerability lies in the SpaceCom administrative interface Version L81/U61 and earlier, and Data module compactplus Versions A10 and A11, facilitating session hijacking and privilege escalation.

Affected Systems and Versions

SpaceCom by B. Braun Melsungen AG (Versions L81/U61 and earlier)
Battery Pack with Wi-Fi by B. Braun Melsungen AG (Versions L81/U61 and earlier)
Data module compactplus by B. Braun Melsungen AG (Versions A10 and A11)

Exploitation Mechanism

The vulnerability can be exploited remotely by attackers to compromise web sessions and gain unauthorized access.

Mitigation and Prevention

Learn how to mitigate and prevent the CVE.

Immediate Steps to Take

Apply updates provided by B. Braun Melsungen AG for affected products
Contact the local B. Braun organization for assistance

Long-Term Security Practices

Protect the network by ensuring devices are not directly accessible from the Internet
Use a firewall to isolate medical devices from the business network

Patching and Updates

Update SpaceCom to Version U62 or later (United States) or L82 or later (outside the United States)
Update Battery Pack SP with Wi-Fi to Version U62 or later (United States) or L82 or later (outside the United States)
Update Data module compactplus to Version A12 or later