CVE-2021-27410 Memory corruption in Welch Allyn medical device management tools
An out-of-bounds write vulnerability in Welch Allyn medical device management tools allows attackers to corrupt data or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27410?
CVE-2021-27410 is a critical memory corruption vulnerability in Welch Allyn medical device management tools, published on 11 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).
Weakness: CWE-787
Which versions are affected by CVE-2021-27410?
It affects 9 products.
Products include Hillrom Connex Central Station, Hillrom Connex Device Integration Suite Network Connectivity Engine, Hillrom Connex Integrated Wall System, Hillrom Connex Spot Monitor, Hillrom Connex Vital Signs Monitor, Hillrom Service Monitor and 3 more.
How do I fix CVE-2021-27410?
No fix has been published for CVE-2021-27410 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-27410 being exploited?
There is no known exploitation of CVE-2021-27410 in the wild and no public exploit code.
Other vulnerabilities in Welch Allyn medical device management tools
Sources
Also known as GHSA-hxpm-jgp4-m58r.