B. Braun Battery Pack SP with Wi-Fi
An improper neutralization of directives in dynamically evaluated code vulnerability in the Wi-Fi Battery embedded web server versions L90/U70 and L92/U92 can be used to gain administrative access to the Wi-Fi communication module. An authenticated user, having access to both the medical device Wi-Fi network (such as a biomedical engineering staff member) and the specific B. Braun Battery Pack SP with Wi-Fi web server credentials, could gain administrative (root) access on the infusion pump communication module. This could be used as a vector to launch further attacks. CVE-2023-0888 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L).