CVE-2021-38394

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1278

Affected software

Vendor	Product	Versions
Boston Scientific	ZOOM LATITUDE	Model 3120

References

https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01Third Party Advisory, US Government Resource

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-383959.8Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which CVE-2021-383966.8The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An CVE-2021-3839710.0Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to re CVE-2021-383986.8The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access CVE-2021-383997.5Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access CVE-2021-38408.8A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote co CVE-2021-384006.8An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted CVE-2021-384017.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allo CVE-2021-384027.8Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. Th CVE-2021-384034.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi CVE-2021-384047.8Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. Th CVE-2021-384057.8The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF file