Security readout for executives and security teams
Plain-English summary
This issue affects specific B. Braun connectivity modules used around infusion devices. A person with local access can bypass access controls to read or alter network configuration. That can undermine device connectivity and network trust, but the cited CVSS vector is local and the bundle provides no evidence of active exploitation.
Executive priority
Treat as a targeted medical-device exposure, not an emergency internet-wide event. Prioritize hospitals or facilities running affected B. Braun connectivity components, especially where local device access is broadly available or network configuration integrity is safety-relevant.
Technical view
CVE-2020-25160 is CWE-284 improper access control in SpaceCom L81/U61 and earlier and Data module compactplus A10/A11; Battery Pack SP with Wi-Fi is listed with unspecified versions. The CVSS 3.1 score is 6.8 with local access, no privileges, no user interaction, changed scope, and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely in healthcare environments using the named B. Braun SpaceCom, Battery Pack SP with Wi-Fi, or Data module compactplus components. Internet-wide exposure is not supported by the bundle; the CVSS vector indicates local access is required.
Exploitation context
The source bundle does not cite CISA KEV listing or active exploitation. Risk depends on whether an attacker, insider, contractor, or compromised local host can access the affected device path and change network configuration.
Researcher notes
Evidence is limited to the CVE description, CVSS vector, affected product statements, and referenced CISA and B. Braun advisories. The bundle does not name exploit code, active exploitation, or a specific patch level, so remediation should be verified against vendor guidance.
Mitigation direction
- Inventory affected B. Braun modules and record firmware or module versions.
- Check B. Braun and CISA advisories for supported updates or compensating controls.
- Restrict local and physical access to affected connectivity modules.
- Review network segmentation around medical device connectivity components.
- Coordinate remediation with clinical engineering and vendor support before changes.
Validation and detection
- Confirm whether SpaceCom is L81/U61 or earlier in deployed environments.
- Confirm whether Data module compactplus versions A10 or A11 are present.
- Identify any Battery Pack SP with Wi-Fi assets and vendor-confirm applicability.
- Review device network configuration for unauthorized or unexplained changes.
- Document compensating controls and vendor remediation status for each asset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-25160 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L2.53.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02CVE reference · x_refsource_CONFIRM
- https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.htmlCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.