CVE-2021-27503
Medium
Description
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application encrypts on the application layer of the communication protocol between the Ypsomed mylife App and mylife Cloud credentials based on hard-coded secrets, which allows man-in-the-middle attackers to tamper with messages.
SeverityMedium
CVSS4.8
Exploit probability—
ProductYpsomed Mylife
PublishedAug 2, 2021
First seenAug 2, 2021
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- ypsomed mylife1.7.5 or later
- ypsomed mylife_cloud1.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ypsomed mylife | v < 1.7.5 | 1.7.5 |
| ypsomed mylife_cloud | v < 1.7.2 | 1.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.