CVE-2020-25150
📋 TL;DR
This vulnerability allows attackers with service user privileges to perform relative path traversal attacks in B. Braun medical devices. By uploading specially crafted tar files, attackers can execute arbitrary commands on affected SpaceCom and Data module compactplus systems. This affects healthcare organizations using these specific medical device management systems.
💻 Affected Systems
- B. Braun SpaceCom
- B. Braun Data module compactplus
📦 What is this software?
Spacecom by Bbraun
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, potentially disrupting medical device operations, accessing patient data, or modifying device configurations in healthcare environments.
Likely Case
Attackers with service user access could upload malicious files to execute commands, potentially disrupting medical device management systems or exfiltrating sensitive healthcare data.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated medical device management networks with minimal patient safety risk.
🎯 Exploit Status
Requires service user credentials and ability to upload tar files. Path traversal technique combined with tar file manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SpaceCom Version L82/U62 or later; Data module compactplus Version A12 or later
Vendor Advisory: https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
Restart Required: Yes
Instructions:
1. Contact B. Braun technical support for patching instructions. 2. Schedule maintenance window for medical device updates. 3. Apply vendor-provided patches. 4. Restart affected systems. 5. Verify patch installation.
🔧 Temporary Workarounds
Restrict file upload permissions
allLimit service user file upload capabilities to prevent tar file uploads
Network segmentation
allIsolate medical device management systems from general network access
🧯 If You Can't Patch
- Implement strict access controls limiting service user privileges
- Monitor for unusual file upload activities and tar file processing
🔍 How to Verify
Check if Vulnerable:
Check device version against affected versions: SpaceCom L81/U61 or earlier, Data module compactplus A10/A11Check Version:
Check device interface or contact B. Braun support for version verificationVerify Fix Applied:
Verify device shows SpaceCom Version L82/U62 or later, or Data module compactplus Version A12 or later📡 Detection & Monitoring
Log Indicators:
- Unusual tar file uploads by service users
- File upload attempts with path traversal patterns
- Unexpected command execution events
Network Indicators:
- File upload traffic to medical device management systems
- Unusual outbound connections from medical devices
SIEM Query:
source="medical_device" AND (event="file_upload" AND file_extension="tar") OR (event="command_execution" AND user="service_user")🔗 References
- https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
- https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02
- https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
- https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02
