CVE-2021-38392

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Boston Scientific	ZOOM LATITUDE	Model 3120

References

https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01Third Party Advisory, US Government Resource

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-383939.8A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 CVE-2021-383946.4An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could CVE-2021-383959.8Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which CVE-2021-383966.8The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An CVE-2021-3839710.0Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to re CVE-2021-383986.8The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access CVE-2021-383997.5Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access CVE-2021-38408.8A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote co CVE-2021-384006.8An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted CVE-2021-384017.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allo CVE-2021-384027.8Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. Th CVE-2021-384034.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi