Security readout for executives and security teams
Plain-English summary
This flaw affects B. Braun medical device communication components. A user with service-level access could upload a malicious archive that escapes the intended file path and causes command execution. The business risk is disruption or unauthorized changes around infusion-related infrastructure, but the sources do not show active exploitation.
Executive priority
Treat this as high priority where affected B. Braun systems are deployed, especially in clinical networks. It is not marked as known exploited, but command execution in medical device infrastructure warrants prompt inventory, access review, and vendor-guided remediation.
Technical view
CVE-2020-25150 is a relative path traversal issue in upload handling. In SpaceCom L81/U61 and earlier and Data module compactplus A10/A11, a service user can upload arbitrary files via a crafted tar archive, leading to arbitrary command execution. CVSS is 7.6 high.
Likely exposure
Exposure is most likely in healthcare or clinical engineering networks using B. Braun SpaceCom, Battery Pack SP with Wi-Fi, or Data module compactplus. Internet exposure is not stated in the sources; validation should focus on asset inventory, firmware/version records, and service-account access paths.
Exploitation context
The source bundle does not identify public exploitation or CISA KEV listing. Exploitation requires service user privileges, lowering broad opportunistic risk but making compromised credentials, vendor access, or weak operational controls important concerns.
Researcher notes
The key condition is authenticated service-user access. The supplied evidence does not include patch identifiers, exploit availability, or detailed vendor remediation text. Keep testing non-disruptive and coordinated with clinical engineering because affected systems may support patient-care workflows.
Mitigation direction
- Check B. Braun and CISA guidance for supported updates or compensating controls.
- Identify and prioritize affected SpaceCom and Data module compactplus versions.
- Restrict service user access to authorized maintenance personnel only.
- Segment affected medical device networks from general IT and internet paths.
- Review service account credential hygiene and remove unnecessary access.
- Increase monitoring for unexpected file uploads or configuration changes.
Validation and detection
- Inventory B. Braun SpaceCom, Wi-Fi battery packs, and Data module compactplus assets.
- Confirm whether SpaceCom is L81/U61 or earlier.
- Confirm whether Data module compactplus is A10 or A11.
- Review who has service user privileges on affected devices.
- Check logs for unusual uploads, maintenance activity, or unexpected file changes.
- Document clinical dependencies before remediation or isolation changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-23: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-25150 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L2.84.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.6HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02CVE reference · x_refsource_CONFIRM
- https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.htmlCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Relative Path Traversal
Relative Path Traversal represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.