CVE Feed

    Dashboard / CVE / CVE-2020-25166

    CVE-2020-25166

    An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.

    Published:Apr 14, 2022
    Last Modified:Apr 16, 2025
    EPS:Apr 14, 2022
    EPSS Score:0.00085
    CVSS Score:7.6

    Affected Products

    Vendor
    Bbraun
    Product
    Datamodule Compactplus
    Vendor
    Bbraun
    Product
    Spacecom

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-463 Padding Oracle Crypto Attack
    CAPEC-475 Signature Spoofing by Improper Validation

    Related CVEs

    CVE-2020-25168 (CVSS 3.3) — Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module …
    CVE-2020-25164 (CVSS 6.5) — A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compact…
    CVE-2020-25154 (CVSS 5.4) — An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Ve…
    CVE-2020-25162 (CVSS 7.5) — A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Dat…
    CVE-2020-25158 (CVSS 7.6) — A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and…
    CVE-2020-25152 (CVSS 6.5) — A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U6…
    CVE-2020-25160 (CVSS 6.8) — Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data modul…
    CVE-2020-16238 (CVSS 6.7) — A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 an…
    CVE-2020-25156 (CVSS 7.2) — Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versio…
    CVE-2020-25150 (CVSS 7.6) — A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Da…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High