Security readout for executives and security teams
Plain-English summary
Boston Scientific ZOOM LATITUDE Model 3120 has an access-control weakness where someone with physical access could alter a device setting tied to telemetry region. That could let the device interact with implantable devices outside its intended region. This is operationally important for clinical environments, but the source describes a physical-access scenario, not remote compromise.
Executive priority
Treat this as a moderate clinical technology risk. It is not described as remotely exploitable, but unauthorized programming capability can create patient-safety and regulatory concerns. Prioritize inventory, physical control verification, and vendor guidance review for affected facilities.
Technical view
CVE-2021-38392 is CWE-284 improper access control affecting Boston Scientific ZOOM LATITUDE Model 3120. A skilled attacker with physical access can access the hard disk drive and change the telemetry region, potentially enabling interrogation or programming of implantable devices in any region. CVSS 3.1 is 6.5, with physical attack vector and high integrity impact.
Likely exposure
Exposure is limited to organizations that use Boston Scientific ZOOM LATITUDE Model 3120 devices, especially clinical or biomedical engineering environments. The provided evidence does not identify other models, remote exposure, internet exposure, or cloud service impact.
Exploitation context
The CVE bundle marks KEV as false, and no cited source states active exploitation. The described attack requires physical access to the affected device, skill, and the CVSS vector includes user interaction. Public evidence in the bundle is incomplete on practical exploit prevalence.
Researcher notes
Do not generalize beyond ZOOM LATITUDE Model 3120 based on the provided sources. The bundle does not name a patch, exploit code, active exploitation, or affected firmware versions. Validation should focus on asset presence, physical access paths, configuration integrity, and vendor advisory details.
Mitigation direction
- Identify any Boston Scientific ZOOM LATITUDE Model 3120 devices in service.
- Review CISA and Boston Scientific guidance for vendor-approved corrective actions.
- Restrict physical access to programmer devices and storage media.
- Monitor device configuration for unauthorized telemetry region changes.
- Escalate affected devices through biomedical engineering and clinical safety governance.
Validation and detection
- Confirm whether ZOOM LATITUDE Model 3120 exists in the asset inventory.
- Verify physical custody controls for each affected device.
- Review configuration records for unexpected telemetry region changes.
- Check maintenance history for unauthorized disk access or tampering indicators.
- Document vendor guidance status and remediation ownership.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-38392 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L0.75.3Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.