CVE-2021-27408 Information disclosure in Welch Allyn medical device management tools
An out-of-bounds read in Welch Allyn medical device tools allows information leakage, potentially enabling arbitrary code execution when chained with other vulnerabilities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27408?
CVE-2021-27408 is a high-severity vulnerability in Welch Allyn medical device management tools, published on 11 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).
Weakness: CWE-125
Which versions are affected by CVE-2021-27408?
It affects 9 products.
Products include Hillrom Connex Central Station, Hillrom Connex Device Integration Suite Network Connectivity Engine, Hillrom Connex Integrated Wall System, Hillrom Connex Spot Monitor, Hillrom Connex Vital Signs Monitor, Hillrom Service Monitor and 3 more.
How do I fix CVE-2021-27408?
No fix has been published for CVE-2021-27408 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27408 being exploited?
There is no known exploitation of CVE-2021-27408 in the wild and no public exploit code.
Other vulnerabilities in Welch Allyn medical device management tools
Sources
Also known as GHSA-3c5f-pfff-9cjf.