CVE-2020-27282

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files.

CVSS v3 4.3 MEDIUM
CVSS v2.0 2.1 LOW

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hamilton-medical:hamilton-t1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hamilton-medical:hamilton-t1:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-15 22:15

Updated : 2021-03-22 16:01

NVD link : CVE-2020-27282

Mitre link : CVE-2020-27282

CVE.ORG link : CVE-2020-27282

JSON object : View

Products Affected

hamilton-medical

hamilton-t1
hamilton-t1_firmware

CWE

CWE-112

Missing XML Validation

{"id": "CVE-2020-27282", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "published": "2021-03-15T22:15:13.017", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-112"}]}], "descriptions": [{"lang": "en", "value": "In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files."}, {"lang": "es", "value": "En Hamilton Medical AG, T1-Ventillator versiones 2.2.3 y anteriores, la vulnerabilidad de comprobaci\u00f3n XML en el ventilator permite a atacantes privilegiados con acceso f\u00edsico a renderizar el dispositivo de forma persistente al cargar archivos de configuraci\u00f3n especialmente dise\u00f1ados"}], "lastModified": "2021-03-22T16:01:32.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hamilton-medical:hamilton-t1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "425D6578-CE4D-4417-B92C-12C10C837EC2", "versionEndIncluding": "2.2.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hamilton-medical:hamilton-t1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3F037FC9-EE0F-4328-9BB1-0628DB4B66FA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}