CVE-2021-27408
Description
The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).
How to fix
- hillrom connex_central_station1.8.6 or later
- hillrom connex_device_integration_suite_network_connectivity_engine5.3 or later
- hillrom connex_integrated_wall_system2.43.02 or later
- hillrom connex_spot_monitor1.52 or later
- hillrom connex_vital_signs_monitor2.43.02 or later
- hillrom service_monitor1.7.0.0 or later
- hillrom service_tool1.10 or later
- hillrom software_development_kit3.2 or later
- hillrom spot_vital_signs_44001.11.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hillrom connex_central_station | v < 1.8.6 | 1.8.6 |
| hillrom connex_device_integration_suite_network_connectivity_engine | v < 5.3 | 5.3 |
| hillrom connex_integrated_wall_system | v < 2.43.02 | 2.43.02 |
| hillrom connex_spot_monitor | v < 1.52 | 1.52 |
| hillrom connex_vital_signs_monitor | v < 2.43.02 | 2.43.02 |
| hillrom service_monitor | v < 1.7.0.0 | 1.7.0.0 |
| hillrom service_tool | v < 1.10 | 1.10 |
| hillrom software_development_kit | v < 3.2 | 3.2 |
| hillrom spot_vital_signs_4400 | v < 1.11.00 | 1.11.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.