CVE-2023-0888: Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi
First published: Mon Mar 13 2023(Updated: )
An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks
Credit: productsecurity@bbraun.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bbraun Battery-pack Sp With Wifi | <=053l000092 | |
| Bbraun Battery-pack Sp With Wifi | <=054u000092 | |
| Bbraun Battery-pack Sp With Wifi Firmware |
Remedy
Update to version L93/U93 or newer solves the issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-0888?
CVE-2023-0888 is an improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server.
Which versions of Bbraun Battery-pack Sp With Wifi Firmware are affected by CVE-2023-0888?
Versions L90/U70 and L92/U92 of Bbraun Battery-pack Sp With Wifi Firmware are affected by CVE-2023-0888.
How can CVE-2023-0888 be exploited?
CVE-2023-0888 can be exploited by an authenticated user with access to both the medical device WiFi communication module.
What is the severity of CVE-2023-0888?
CVE-2023-0888 has a severity score of 7.2, which is considered high.
How can I fix CVE-2023-0888?
To fix CVE-2023-0888, it is recommended to apply the security patches provided by Bbraun.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/bbraun
- canonical/bbraun battery-pack sp with wifi
- version/bbraun battery-pack sp with wifi/053l000092
- version/bbraun battery-pack sp with wifi/054u000092
- canonical/bbraun battery-pack sp with wifi firmware