CVE-2021-43935

ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products

State: Published
Severity: 8.1 High
Published: Dec 15, 2021
Updated: Sep 16, 2024
Reserved: Nov 16, 2021

Description

The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
Welch Allyn Q-Stress Cardiac Stress Testing SystemHillrom	6.0.0 through 6.3.1Affected
Welch Allyn X-Scribe Cardiac Stress Testing SystemHillrom	5.01 through 6.3.1Affected
Welch Allyn Diagnostic Cardiology SuiteHillrom	2.1.0Affected
Welch Allyn Vision ExpressHillrom	6.1.0 through 6.4.0Affected
Welch Allyn H-Scribe Holter Analysis SystemHillrom	5.01 through 6.4.0Affected
Welch Allyn R-Scribe Resting ECG SystemHillrom	5.01 through 7.0.0Affected
Welch Allyn Connex CardioHillrom	1.0.0 through 1.1.1Affected

References

https://www.cisa.gov/uscert/ics/advisories/icsma-21-343-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.