description: A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical information collection devices running versions 9.0.3 or lower. A specific series of keyboard inputs can escape the restricted environment, resulting in full administrator access to the underlying operating system. An attacker can connect to the device via USB port with a keyboard or other HID device to trigger this vulnerability.
problem types: CWE-693: Protection Mechanism Failure
affected:
{
product: Capsule Technologies SmartLinx Neuron 2
vendor: Capsule Technologies
versions:
status: affected, version: 9.0.3 or lower
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]