CVE-2021-37160
Last modified
CVE-2021-37160 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.. EPSS estimates a 8.23% chance of exploitation in the next 30 days.
Description
A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Swisslog-Healthcare | Hmi-3 Control Panel Firmware | < 7.2.5.7 |
References
- https://www.armis.com/PwnedPiperBroken Link
- https://www.armis.com/PwnedPiperBroken Link
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-37160?
How severe is CVE-2021-37160?
How do I fix CVE-2021-37160?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-37155wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a …9.8
- CVE-2021-37156Redmine 4.2.0 and 4.2.1 allow existing user sessions to cont…7.5
- CVE-2021-37157An issue was discovered in OpenGamePanel OGP-Agent-Linux thr…8.8
- CVE-2021-37158An issue was discovered in OpenGamePanel OGP-Agent-Linux thr…8.8
- CVE-2021-37159hso_free_net_device in drivers/net/usb/hso.c in the Linux ke…6.4
- CVE-2021-3716A flaw was found in nbdkit due to to improperly caching plai…3.1
- CVE-2021-37161A buffer overflow issue was discovered in the HMI3 Control P…9.8
- CVE-2021-37162A buffer overflow issue was discovered in HMI3 Control Panel…9.8
- CVE-2021-37163An insecure permissions issue was discovered in HMI3 Control…9.8
- CVE-2021-37164A buffer overflow issue was discovered in HMI3 Control Panel…9.8
- CVE-2021-37165A buffer overflow issue was discovered in HMI3 Control Panel…9.8
- CVE-2021-37166A buffer overflow issue leading to denial of service was dis…7.5
Are you affected by CVE-2021-37160?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST