Security readout for executives and security teams
Plain-English summary
This issue affects B. Braun SpaceCom2 versions before 012U000062. A remote attacker could change device configuration because some proprietary networking commands lacked authentication. The public bundle does not show active exploitation, but unauthorized configuration changes in infusion infrastructure can create clinical and operational risk.
Executive priority
Treat as a healthcare operational risk requiring inventory and remediation planning, not an internet-scale emergency. Prioritize affected clinical sites, verify fixed versions, and coordinate changes with biomedical engineering and the vendor.
Technical view
CVE-2021-33882 is missing authentication for a critical function in SpaceCom2 before 012U000062. The CVSS 3.1 vector is network-accessible, no privileges, no user interaction, high attack complexity, changed scope, and high integrity impact only. The bundle lists no CWE and incomplete affected-product metadata.
Likely exposure
Exposure is most likely in healthcare networks running B. Braun SpaceCom2 earlier than 012U000062. Risk increases if devices are reachable from broad internal networks or poorly segmented environments. The source bundle’s structured affected list is incomplete.
Exploitation context
No KEV listing or provided source states active exploitation. The CVE describes remote reconfiguration from an unknown source using unauthenticated proprietary networking commands, but high attack complexity limits broad opportunistic risk based on the supplied CVSS vector.
Researcher notes
The description is specific, but the structured affected data is n/a and no CWE is supplied. Avoid assuming other B. Braun products are affected. Use the CVE record, CVE JSON, vendor materials, and McAfee analysis to confirm exact scope.
Mitigation direction
- Identify all B. Braun SpaceCom2 deployments and versions.
- Prioritize upgrades to 012U000062 or later where vendor guidance confirms applicability.
- Check B. Braun guidance before applying device or clinical-network changes.
- Restrict device management access to trusted clinical engineering networks.
- Review segmentation and monitoring around infusion pump infrastructure.
Validation and detection
- Confirm whether any SpaceCom2 systems run versions before 012U000062.
- Validate device management paths are not broadly reachable across the network.
- Compare device configuration against approved clinical engineering baselines.
- Review vendor documentation for the exact fixed release and deployment process.
- Document exceptions where upgrades require clinical or vendor coordination.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-33882 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:C/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:C/UI:N2.24Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:C/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.bbraunusa.com/en.htmCVE reference · x_refsource_MISC
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.