CVE-2020-27290

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers with physical access to the configuration interface's logs to get valid checksums for tampered configuration files.

CVSS v3 4.3 MEDIUM
CVSS v2.0 2.1 LOW

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hamilton-medical:hamilton-t1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hamilton-medical:hamilton-t1:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-15 22:15

Updated : 2024-02-04 21:23

NVD link : CVE-2020-27290

Mitre link : CVE-2020-27290

CVE.ORG link : CVE-2020-27290

JSON object : View

Products Affected

hamilton-medical

hamilton-t1
hamilton-t1_firmware

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2020-27290", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "published": "2021-03-15T22:15:13.077", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers with physical access to the configuration interface's logs to get valid checksums for tampered configuration files."}, {"lang": "es", "value": "En Hamilton Medical AG, T1-Ventillator versiones 2.2.3 y anteriores, una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en el ventilator permite a atacantes con acceso f\u00edsico a los registros de la interfaz de configuraci\u00f3n obtener sumas de comprobaci\u00f3n v\u00e1lidas para archivos de configuraci\u00f3n alterados"}], "lastModified": "2021-03-22T16:02:31.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hamilton-medical:hamilton-t1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "425D6578-CE4D-4417-B92C-12C10C837EC2", "versionEndIncluding": "2.2.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hamilton-medical:hamilton-t1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3F037FC9-EE0F-4328-9BB1-0628DB4B66FA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}