Description
A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| B. Braun Melsungen | SpaceCom | unspecified – ≤ U61, unspecified – ≤ L81 | — |
| B. Braun Melsungen | Battery pack with Wi-Fi | unspecified – ≤ U61, unspecified – ≤ L81 | — |
| B. Braun Melsungen | Data module compactplus | A10, A11 | — |
Advisories 1
- ICSMA-20-296-02 B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus CISA ICS & IT advisories · Oct 22, 2020