Rocco Gagliardi

A critical issue affects the Service Browser, which introduces hard-coded credentials. Local attack is required to exploit this issue. It is recommended to change the configuration settings to mitigate the risk.

A vulnerability has been found in the file `/uscgi-bin/users.cgi` of the Service Browser, leading to improper authentication and elevated access possibilities. The attack can be launched on the local host.

A critical issue was found in the affected software, related to the underlying Windows XP operating system. The lack of patches may increase the attack surface. To exploit this issue, access to the local network is required.

The issue allows an attacker to break out of the kiosk mode and reach the underlying operating system via a specific dialog. This enables the attacker to take control of the operating system.

The issue allows log files to be accessed over an unauthenticated network connection. This access enables an attacker to gain insights into the internals of the patient monitor, its location, and the wired network configuration.

An open redirect issue was discovered in the B. Braun Medical SpaceCom module. The web server of the affected product accepts untrusted input, which could allow attackers to redirect the request to an unintended URL contained within untrusted input.