CVE-2021-37166
Last modified
CVE-2021-37166 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When HMI3 starts up, it binds a local service to a TCP port on all interfaces of the device, and takes extensive time for the GUI to connect to the TCP socket, allowing the connection to be hijacked by an external attacker.. EPSS estimates a 1.84% chance of exploitation in the next 30 days.
Description
A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When HMI3 starts up, it binds a local service to a TCP port on all interfaces of the device, and takes extensive time for the GUI to connect to the TCP socket, allowing the connection to be hijacked by an external attacker.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Swisslog-Healthcare | Hmi-3 Control Panel Firmware | < 7.2.5.7 |
References
- https://www.armis.com/PwnedPiperBroken Link
- https://www.armis.com/PwnedPiperBroken Link
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-37166?
How severe is CVE-2021-37166?
How do I fix CVE-2021-37166?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-37160A firmware validation issue was discovered in HMI3 Control P…9.8
- CVE-2021-37161A buffer overflow issue was discovered in the HMI3 Control P…9.8
- CVE-2021-37162A buffer overflow issue was discovered in HMI3 Control Panel…9.8
- CVE-2021-37163An insecure permissions issue was discovered in HMI3 Control…9.8
- CVE-2021-37164A buffer overflow issue was discovered in HMI3 Control Panel…9.8
- CVE-2021-37165A buffer overflow issue was discovered in HMI3 Control Panel…9.8
- CVE-2021-37167An insecure permissions issue was discovered in HMI3 Control…9.8
- CVE-2021-3717A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER c…7.8
- CVE-2021-37172A vulnerability has been identified in SIMATIC S7-1200 CPU f…7.5
- CVE-2021-37173A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.8
- CVE-2021-37174A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.8
- CVE-2021-37175A vulnerability has been identified in RUGGEDCOM ROX MX5000 …5.3
Are you affected by CVE-2021-37166?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST