CVE-2021-38392

MEDIUM

Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor 3120 - Improper Access Control

Title source: manual
STIX 2.1

Description

A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01

Scores

CVSS v3 6.5
EPSS 0.0024
EPSS Percentile 15.4%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Details

CWE
CWE-284
Status published
Products (1)
bostonscientific/zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware
Published Oct 04, 2021
Tracked Since Feb 18, 2026