CVE-2021-37162:

Buffer overflow vulnerability in Swisslog Healthcare Nexus Panel HMI3 Control Panel allows remote code execution through malformed UDP messages.

This vulnerability exists in the Swisslog Healthcare Nexus Panel, specifically in the HMI3 Control Panel component. The issue is classified as CWE-120 (Buffer Copy without Checking Size of Input). When processing certain UDP messages, the system fails to properly validate input size, leading to a buffer underflow condition. This vulnerability is part of a larger set of security issues discovered in the Swisslog pneumatic tube systems, collectively referred to as "PwnedPiper" by security researchers at Armis. These systems are widely used in hospitals for transporting medications, lab samples, and other critical materials. A successful exploitation could potentially allow attackers to gain unauthorized access to the system, disrupt hospital operations, or potentially compromise patient care by interfering with the delivery of critical medical supplies.