CVE-2020-27256 Hardcoded credentials in SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
Attackers with physical access can use a hard-coded physician PIN to alter insulin therapy settings on SOOIL insulin pumps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27256?
CVE-2020-27256 is a medium-severity vulnerability in SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, published on 19 Jan 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers with physical access to change insulin therapy settings.
Weakness: CWE-798
Which versions are affected by CVE-2020-27256?
It affects 3 products.
Products include Sooil Anydana-a Firmware, Sooil Anydana-I Firmware, Sooil Diabecare Rs Firmware.
How do I fix CVE-2020-27256?
No fix has been published for CVE-2020-27256 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-27256 being exploited?
There is no known exploitation of CVE-2020-27256 in the wild and no public exploit code.
Other vulnerabilities in SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
- CVE-2020-27264 Weak cryptography in SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
- CVE-2020-27266 Auth bypass in SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
- CVE-2020-27268 Security feature bypass in SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
- CVE-2020-27269 Other in SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
- CVE-2020-27270 Weak cryptography in SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
Sources
Also known as GHSA-8v8f-rjrw-vg47.