Causal model
What has to happen for this consequence to hold?
2 candidate paths · explicit source, inference, and assumption boundaries.
Safety · Co-dominant path
Device-control safety
Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.
Network-reachable without prior access
The vulnerable SpaceCom2 or wireless battery-pack service is reachable without authentication from the hospital network.
EvidenceNVD
Cross-domain authority chain
The chain crosses from the hospital network into SpaceCom, pump configuration, and ultimately delivered therapy.
EvidenceNo direct citation — inspect the declared inference or assumption.
Severe therapy or actuation consequence
Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.
EvidenceNo direct citation — inspect the declared inference or assumption.
Device-control safety
Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
Recovery requires patched SpaceCom and battery-pack firmware plus network hardening and verification across affected pumps.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 4 - Network-reachable without prior access
The vulnerable SpaceCom2 or wireless battery-pack service is reachable without authentication from the hospital network.
- Execution complexity
EC 2 - Specialist multi-step technique
The demonstrated dose-alteration outcome combines five flaws and requires a specialist multi-stage chain, despite the open network entry point.
- Exposure
EX 2 - Execution effort limits exposure
The interface is broadly reachable, but the required technique keeps practical exposure below that reach.
Consequence
- Physical / safety
PH 4 - Severe therapy or actuation consequence
Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.
- Data / perception
DP 3 - Sensitive device or personal data
The chain reads and changes drug-library, configuration, firmware-adjacent, and operational state used for infusion.
- Authority
AT 3 - Administrative or command authority
The attacker can write pump configuration and execute commands on SpaceCom, but does not obtain a B. Braun signing key.
Scale and recovery
- Chainability
CH 4 - Cross-domain authority chain
The chain crosses from the hospital network into SpaceCom, pump configuration, and ultimately delivered therapy.
- Reuse scale
SR 3 - Portable product-class technique
The same product and firmware weaknesses are portable across affected Space systems without a universal signing secret.
- Execution scale
SX 4 - Remote fleet-scale execution
Unauthenticated network access can reach many same-model pumps within a facility without per-device physical contact.
- Recovery burden
OR 3 - Coordinated operational recovery
Recovery requires patched SpaceCom and battery-pack firmware plus network hardening and verification across affected pumps.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Patch available - A patch is available
A vendor fix is available, while deployment and upgrade completion remain separate operational questions.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:2/EX:2/PH:4/DP:3/AT:3/CH:4/SR:3/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLERead the scoring method →Privacy · Co-dominant path
Data privacy
The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.
Network-reachable without prior access
The same unauthenticated hospital-network position exposes the device service used by this read path.
EvidenceNVD
One cross-boundary bridge
The network service crosses into pump application data and can supply reconnaissance for the separate safety chain.
EvidenceNo direct citation — inspect the declared inference or assumption.
Sensitive device or personal data
The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.
EvidenceNo direct citation — inspect the declared inference or assumption.
Data privacy
The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
The deployment needs the same fixed firmware and network hardening, followed by review of any state that may have been exposed.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 4 - Network-reachable without prior access
The same unauthenticated hospital-network position exposes the device service used by this read path.
- Execution complexity
EC 3 - Reproducible exploit workflow
Reading configuration and operational state is a reproducible network workflow once the service is reached.
- Exposure
EX 3 - Execution effort limits exposure
The interface is broadly reachable, but the required technique keeps practical exposure below that reach.
Consequence
- Physical / safety
PH 0 - No direct physical effect
This path is limited to confidentiality; dose manipulation and physical harm are assessed separately.
- Data / perception
DP 3 - Sensitive device or personal data
The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.
- Authority
AT 2 - Bounded function authority
The read operation provides bounded access to device state rather than command, administrator, or signing authority.
Scale and recovery
- Chainability
CH 2 - One cross-boundary bridge
The network service crosses into pump application data and can supply reconnaissance for the separate safety chain.
- Reuse scale
SR 2 - Repeatable method
The same read workflow applies across affected models, but it does not depend on a shared credential.
- Execution scale
SX 4 - Remote fleet-scale execution
The unauthenticated service can be queried across reachable same-model pumps without physical access.
- Recovery burden
OR 3 - Coordinated operational recovery
The deployment needs the same fixed firmware and network hardening, followed by review of any state that may have been exposed.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Patch available - A patch is available
A vendor fix is available, while deployment and upgrade completion remain separate operational questions.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:3/EX:3/PH:0/DP:3/AT:2/CH:2/SR:2/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLERead the scoring method →Triage implication
Verify the safety transition before acting on the band.
Validate the deployment-specific transition from digital control or perception to physical action before setting remediation urgency.
Evidence ledger
Public sources used by this record.
Every named source includes a public link. Path review remains separate from citation coverage.
- advisoryNVD
NVD
Published baseline
Keep exploit severity and consequence reasoning distinct.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE recordsCVE-2021-33885
Original scorer notes
The source narrative behind the structured explanation.
Retained for provenance and historical review, not as the recommended way to understand the assessment.
Read the original scorer notes
Assessment
CFSE Consequence Paths assesses B. Braun Infusomat/Perfusor Space (SpaceCom2 / Battery pack SP with Wi-Fi) - remote unauthenticated dose alteration at CRITICAL — the worst of 2 risk paths (safety, perception). The dominant consequence is influence over a safety-relevant actuation.
Vulnerability
B. Braun Infusomat/Perfusor Space (SpaceCom2 / Battery pack SP with Wi-Fi) - remote unauthenticated dose alteration.
CFSE Consequence Paths analysis
The vulnerability is decomposed into one risk path per terminal consequence. Each path is scored on its exposure (reachability × execution complexity) and the authority, perception, and physical/safety it reaches, together with its scale of reuse, scale of execution, and recoverability.
DEVICE_CONTROL_SAFETY → CRITICAL
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:2/EX:2/PH:4/DP:3/AT:3/CH:4/SR:3/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLE
Exposure EX=2 (execution complexity-bound) · bands PH=CRITICAL · DP=HIGH · AT=HIGH → base CRITICAL · uplift fleet-reachable authority → assessed CRITICAL.
Remote unauthenticated network reachability on hospital LAN/Wi-Fi (AV:N/PR:N/UI:N) = RE:4. The keystone data-authenticity flaw is AC:L, but the demonstrated patient-harm outcome requires assembling the five-bug chain (config/drug-library write + SpaceCom escalation/command exec), reproduced on real hardware = advanced-but-reproducible EC:2. PH:4: silent drug-library/config modification in standby causes the next infusion to deliver an unexpected dose - direct credible patient injury pathway, and staff/pump perceive the dose as correct (perception_feeds_action). AT:3: chain gives unauthenticated write to pump configuration plus command execution/privilege escalation on the SpaceCom module (admin/service-level control of command/config), not a true signing-root/OTA-root, so not AT:4. DP:3: firmware/config/operational-state exposure feeds the attack. CH:4 and boundary_crossing: crosses network->device->configuration->physical/therapy domains, reusable cross-domain authority transfer. SR:3: shared same-model firmware/config weakness portable across the deployment, not a single shared signing key (SR:4). SX:4: network-based and unauthenticated allows targeting many same-model pumps facility-wide without per-device physical/proximity access. OR:3: vendor patches (battery-pack SP / SpaceCom2 firmware) plus network hardening needed across affected devices, but not a recall/signing-root rotation, so not OR:4. EV:3 reproduced by Trellix, no confirmed in-the-wild use = active_exploitation false. LS PATCH_AVAILABLE.
DATA_PRIVACY → CRITICAL
CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:3/EX:3/PH:4/DP:3/AT:2/CH:2/SR:2/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLE
Exposure EX=3 (execution complexity-bound) · bands PH=CRITICAL · DP=HIGH · AT=HIGH → base CRITICAL · caps privacy-only cap → assessed CRITICAL.
Same remote unauthenticated network position = RE:4. Reading device configuration and operational data over the network is a standard researcher workflow once positioned = EC:3. C:H in the CVSS reflects exposure of device/config and operational state = DP:3 (firmware/proprietary/sensitive-operational-state class), not biometric/health-record sensitive nav/world-model (DP:4). No safety/physical effect on this pure-confidentiality path = PH:0; the exposed data is config/telemetry not used to drive a physical/safety decision, so perception_feeds_action false. AT:2: bounded read/component-level access to device state. CH:2 with boundary_crossing: crosses network->device app boundary and can feed the safety chain but on its own is a bounded read. SR:2: same-model config exposure, portable telemetry-level knowledge, not a shared key. SX:4: unauthenticated network read scales fleet-wide across same-model pumps. OR:3: same firmware/network-hardening remediation. EV:3 reproduced, no in-the-wild exploitation.
Published baseline
- v3.1 10 CRITICAL —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N— MITRE via NVD - v3.1 9.8 CRITICAL —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H— NVD
The published baseline above is retained for source review. Paths decomposes the consequence into authority, perception, safety, scale, and recoverability paths rather than using the baseline score as the primary registry frame.
Sources
CFSE Consequence Paths Registry 1.0-candidate, CPATH-2026-0040 (“B. Braun Infusomat/Perfusor Space (SpaceCom2 / Battery pack SP with Wi-Fi) - remote unauthenticated dose alteration”), paths.cfse.ai/CPATH-2026-0040 (published 2026-06-03).