CVE-2021-37161:

Buffer overflow vulnerability in Swisslog Healthcare Nexus Panel HMI3 Control Panel allows remote code execution.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Aug 2, 2021
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:7.6
EPSS Percentile:92%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Buffer overflow vulnerability in Swisslog Healthcare Nexus Panel HMI3 Control Panel allows remote code execution.

Overview

The vulnerability exists in the UDP packet handling functionality of the Nexus Panel's HMI3 Control Panel. When processing certain UDP packets, the software fails to properly validate input size, resulting in a buffer overflow condition. An attacker with network access to the affected system can exploit this vulnerability to overwrite memory, corrupt data structures, and potentially execute arbitrary code with the privileges of the running application. This could lead to complete system compromise, allowing attackers to disrupt hospital operations, manipulate data, or use the system as an entry point for broader network attacks. The vulnerability is particularly concerning as these systems are widely deployed in healthcare facilities and play a critical role in hospital operations.

Remediation

1. Update to Nexus Software version 7.2.5.7 or later, which contains fixes for this vulnerability.
2. If immediate patching is not possible, implement network segmentation to restrict access to the Nexus Panel systems from untrusted networks.
3. Monitor network traffic to and from the Nexus Panel systems for suspicious activity.
4. Implement proper access controls and authentication mechanisms for all network-connected devices.
5. Contact Swisslog Healthcare technical support for assistance with applying the necessary updates.
6. Conduct a security assessment of your pneumatic tube system infrastructure to identify any additional vulnerabilities or misconfigurations.
7. Follow the specific guidance provided in Swisslog Healthcare's security bulletin for this vulnerability.