title: B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
description: A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user.
problem types: CWE-269: Improper Privilege Management
affected:
{
product: SpaceCom
vendor: B. Braun Melsungen AG
versions:
lessThanOrEqual: U61, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: L81, status: affected, version: unspecified, versionType: custom
}
{
product: Battery pack with Wi-Fi
vendor: B. Braun Melsungen AG
versions:
lessThanOrEqual: U61, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: L81, status: affected, version: unspecified, versionType: custom
}
{
product: Data module compactplus
vendor: B. Braun Melsungen AG
versions:
status: affected, version: A10
status: affected, version: A11
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: B. Braun recommends applying updates:
SpaceCom: Version U62 or later (United States), L82 or later (outside the United States)
Battery Pack SP with Wi-Fi: Version U62 or later (United States), L82 or later (outside the United States)
Data module compactplus: Version A12 or later
Please contact your local B. Braun organization to request further help. For more information please see the B. Braun Security Advisory.  https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
workarounds: As a general security measure, B. Braun recommends protecting the network with appropriate mechanisms:
Ensure the devices are not accessible directly from the Internet.
Use a firewall and isolate the medical devices from the business network.
Please contact your local B. Braun organization to request further help. For more information please see the B. Braun Security Advisory.  https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
