CVE-2021-43935

· HIGHModified

← All CVEs

CVSS v3.1

8.1

EPSS

1.08%

Published

Dec 15, 2021

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-288CWE-287

Affected Products (10)

baxter · welch_allyn_connex_cardiovulnerable

baxter · welch_allyn_diagnostic_cardiology_suitevulnerable

baxter · welch_allyn_rscribe_resting_ecg_systemvulnerable

baxter · welch_allyn_vision_express_holter_analysis_systemvulnerable

baxter · welch_allyn_hscribe_holter_analysis_system_firmwarevulnerable

baxter · welch_allyn_hscribe_holter_analysis_system

baxter · welch_allyn_q-stress_cardiac_stress_testing_system_firmwarevulnerable

baxter · welch_allyn_q-stress_cardiac_stress_testing_system

baxter · welch_allyn_xscribe_cardiac_stress_testing_system_firmwarevulnerable

baxter · welch_allyn_xscribe_cardiac_stress_testing_system

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsma-21-343-01

MitigationThird Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsma-21-343-01

MitigationThird Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs