CVE-2021-38394
Missing Protection against Hardware Reverse Engineering Using Integrated Circuit Imaging Techniques for Boston Scientific Zoom Latitude
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.2EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
04 Oct 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted.
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Affected products
Boston Scientific · ZOOM LATITUDEWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →