CVE-2021-43935
ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.
Timeline
- CVE published
- Record last updated
Affected versions
- Hillrom Welch Allyn Q-Stress Cardiac Stress Testing System
From 6.0.0 · through 6.3.1
- Hillrom Welch Allyn X-Scribe Cardiac Stress Testing System
From 5.01 · through 6.3.1
- Hillrom Welch Allyn Diagnostic Cardiology Suite
2.1.0
- Hillrom Welch Allyn Vision Express
From 6.1.0 · through 6.4.0
- Hillrom Welch Allyn H-Scribe Holter Analysis System
From 5.01 · through 6.4.0
- Hillrom Welch Allyn R-Scribe Resting ECG System
From 5.01 · through 7.0.0
- Hillrom Welch Allyn Connex Cardio
From 1.0.0 · through 1.1.1