Unsigned critical data enables remote dose alteration

1. Summary

CVE-2021-33885 is an insufficient-verification-of-data-authenticity flaw in B. Braun’s SpaceCom2 communication module, the WiFi-enabled embedded-Linux comms component of the Infusomat/Perfusor Space infusion-pump platform (also present in SpaceStation and the Battery Pack SP with WiFi) [1][4]. Critical data sets that the module accepts carry no cryptographic signatures, so the device cannot verify their origin and will use attacker-supplied data in place of legitimate data [1]. A remote attacker with network access to the device — and no credentials — can substitute malicious configuration or drug-library data [1]. Chained with five other flaws, this lets the attacker silently alter the pump’s next infusion dose while the pump display and clinical staff still show the prescribed value [5][7].

2. Affected products & versions

The affected ecosystem named across the vendor and researcher sources comprises four hardware items: the Infusomat Space Large Volume Pump (871305U), the SpaceStation docking unit (8713142U), the Battery Pack SP with WiFi, and the Data module compactplus — all four are the components tracked in Section 5 [1][4]. Perfusor Space is part of the same Space platform family. The Data module compactplus (affected build I0050A0010, fixed at I0050A0011 or later per the vendor advisory [4]; also labeled “A12+” [7]) is included here because the vendor advisory lists it alongside SpaceCom and the Battery Pack SP with WiFi in the same remediation [4][7].

Note: version nomenclature differs across sources. The vendor advisory’s “Update C” firmware (011L000093 and the Battery Pack SP builds) [4], NVD’s 012U000062 [1], and “L82+”/“A12+” labels [7] all describe the same remediation; per-cell citation markers above indicate which authority backs each version string.

3. The vulnerability in detail

The defect lives in the SpaceCom2 communication module — the WiFi-enabled, embedded-Linux processor board that fronts B. Braun’s Infusomat/Perfusor Space infusion pumps and appears inside the SpaceStation docking unit and the Battery Pack SP with WiFi [1][4]. SpaceCom is architecturally distinct from the pump’s own therapy-controlling logic: it is the networked “outside” of the device, the surface that talks to the hospital LAN and Wi-Fi, and it is where configuration data and the drug library transit on their way to the pump [8]. Importantly, this embedded Linux system is typically inactive during normal pump operation, which is part of why manipulation of it can go unnoticed [8].

The root cause is narrow and specific: critical data sets processed by SpaceCom2 are not cryptographically signed or otherwise authenticated [1]. Because there is no signature to check, the module has no way to distinguish data that genuinely originated from an authorized source from data forged by an attacker. It simply accepts the payload and acts on it. The NVD record states the vulnerability “allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data,” and characterizes the downstream effect as full system command access on the module [1]. B. Braun’s advisory classifies this as CWE-345, Insufficient Verification of Data Authenticity; NVD records it under the closely related CWE-347, Improper Verification of Cryptographic Signature [4][1]. Both descriptions point at the same underlying gap — the absence of any origin/integrity guarantee on data the device treats as trusted. The device answers the question “should I trust this data?” with an unconditional “yes,” because it never asks whether the data was signed by anyone it recognizes.

The mechanism follows directly. An attacker positioned on a network reachable by SpaceCom2 sends crafted data that the module accepts as legitimate because there is nothing to reject [1]. Where a signature-verifying design would compute or check a cryptographic signature over the incoming configuration or drug-library payload and refuse anything that does not validate against a trusted key, SpaceCom2 performs no such check; the payload flows straight into the data path that the pump later consumes. Two properties of the target compound the effect. First, because SpaceCom is the networked front-end and not the therapy controller, the attacker never needs to defeat the pump’s own safety logic directly — corrupting the data that logic consumes is sufficient. Second, because that front-end is normally dormant during infusion [8], a tampered configuration can sit in place undetected until the pump next draws on it.

On its own, CVE-2021-33885 is the trust gap; its full weaponization comes from chaining it with the other flaws B. Braun’s advisory enumerates: missing authentication on proprietary network commands (CVE-2021-33882), cleartext transmission (CVE-2021-33883), unrestricted/dangerous file upload (CVE-2021-33884), improper input validation / format-string handling (CVE-2021-33886), and path traversal via tar (CVE-2020-25150) [4]. Together these move an attacker from “can talk to the device” to “can execute commands and escalate privilege on SpaceCom,” and from there to writing a modified configuration or drug library into the pump [1][5]. The NVD framing that the flaw leads to full system command access is consistent with this: once unsigned data is accepted and combined with the upload, traversal, and format-string flaws, the attacker’s data becomes attacker’s code on the module [1][4]. The missing-authenticity gap is what makes the rest usable — an upload or traversal primitive that landed a signed-and-verified payload requirement in its path would be blunted; here there is no such requirement to satisfy.

The exploitation chain proceeds in the following stages [4][5][7]. The stage ordering and per-stage CVE roles below follow the vendor advisory’s CVE set [4] and corroborating summaries [5][7]; full byte-level exploitation detail (exact files, services, ports, and message formats) is documented in the two Trellix technical blogs [6][7]:

1. The attacker gains a foothold on the hospital LAN / Wi-Fi that the pump’s SpaceCom2 module is reachable on. No authentication to the device is required; the researchers note direct internet exposure is considered unlikely, so a local-network foothold is the realistic precondition [7].
2. Using missing authentication on the proprietary network commands (CVE-2021-33882) and cleartext transmission (CVE-2021-33883), the attacker interacts with the device and reads its configuration, drug library, and operational state — reconnaissance for the rest of the chain [4].
3. Using unrestricted/dangerous file upload (CVE-2021-33884) and path traversal via tar (CVE-2020-25150), together with this unsigned-critical-data flaw (CVE-2021-33885) and improper input validation / format-string handling (CVE-2021-33886), the attacker places unauthenticated malicious files onto SpaceCom and escalates to command execution and higher privilege [4].
4. With control of SpaceCom, the attacker writes a modified configuration or drug library to the pump. Crucially, this write can only be performed while the pump is in standby — the vendor states an upload cannot be done while a therapy is actively running [4].
5. On the next infusion, the pump delivers a dose derived from the tampered library/config, while the display and the attending staff still see the operator-entered / prescribed value [5]. Because the number on the screen matches what was ordered, the discrepancy is invisible at the point of care; the anomaly can present as a device malfunction and go unnoticed until a substantial amount of drug has already been dispensed [7][8].

The consequence of this design — a device that treats unsigned data as authoritative — is that the integrity of the most safety-critical parameter in the system (how much drug to deliver) rests on network reachability alone. This is the essence of CWE-345/CWE-347: when a system cannot verify authenticity, an attacker’s data is indistinguishable from the vendor’s data, and any downstream action taken on that data inherits the attacker’s intent.

Proof-of-concept status: the full remote, unauthenticated dose-alteration chain was reproduced on real B. Braun hardware by McAfee Enterprise ATR (now Trellix), in partnership with Culinda [5][6]. This is a demonstrated, hardware-validated result, not a theoretical one. Full low-level exploitation detail (exact files, services, ports, and message formats) is documented in Trellix’s technical disclosure blogs — the disclosure post and the “Overmedicated” Part 2 [6][7].

4. Discovery & timeline

The flaws were discovered by Douglas McKee and Philippe Laulheret of McAfee Enterprise Advanced Threat Research (ATR), later Trellix ATR, in partnership with Culinda [5][8]. McAfee ATR reported to B. Braun on January 11, 2021 under responsible disclosure [7][8]. Vendor and CISA remediation activity followed in May 2021 (B. Braun advisory 05/2021) [4][7]. Public researcher disclosure and press coverage appeared in August 2021 [7][8]. CISA published its ICS-Medical advisory as ICSMA-21-294-01 (Update A) in the 2021 timeframe; the “Update A” label indicates the page reflects a revision of the original advisory, and the exact original publication date is not documented in public advisories [3].

5. Technical reference

• CVE: CVE-2021-33885 (keystone). Related chain CVEs: CVE-2021-33882 (missing authentication), CVE-2021-33883 (cleartext transmission), CVE-2021-33884 (unrestricted upload), CVE-2021-33886 (improper input validation / format string), CVE-2020-25150 (path traversal via tar) [4].
• Affected hardware: Infusomat Space Large Volume Pump (871305U); SpaceStation (8713142U); Battery Pack SP with WiFi; Data module compactplus — all four per the vendor advisory and NVD [1][4].
• CWE: CWE-345 (Insufficient Verification of Data Authenticity) per vendor/MITRE framing; CWE-347 (Improper Verification of Cryptographic Signature) per NVD [4][1]. Both describe the absence of cryptographic signatures on critical data.
• CVSS: NVD CVSS v3.1 base 9.8 CRITICAL, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [1]. What the metrics mean here: AV:N — reachable over the network; AC:L — no special conditions beyond a network foothold; PR:N / UI:N — no credentials and no user interaction needed against the device; C:H/I:H/A:H — full compromise of confidentiality, integrity, and availability of the affected data/system. MITRE’s scope-changed rendering reaches 10.0 [1].
• Code/commit refs: none public; low-level detail resides in the Trellix blogs [6].

6. Consequence & CFSE path analysis

Real-world consequence: a remote attacker with no credentials, sitting on a hospital LAN or Wi-Fi, can cause an infusion pump to deliver an unexpected — potentially lethal — dose of medication to a patient, while the pump’s display and the clinical staff see the correct prescribed value, and while the whole event may look like an ordinary device malfunction until a dangerous amount of drug has already been given [5][7][8]. This is a patient-safety outcome, not merely a data-security one.

Why the CFSE Path Score differs from CVSS: CVSS 9.8 already flags this as critical, but it scores the vulnerability in the abstract — network-reachable, unauthenticated, high CIA impact. The CFSE path analysis instead scores the consequence reached through a concrete, reproduced exploitation path, and it decomposes the single CVE into two co-dominant consequence paths.

The path bands and verdict:

• DEVICE_CONTROL_SAFETY (safety) path — CRITICAL. Models remote, unauthenticated hospital-LAN/Wi-Fi reachability (RE:4) chained through a five-bug sequence (config/drug-library write plus SpaceCom command execution and privilege escalation) that silently modifies the pump’s drug library or configuration while it is in standby, so the next infusion delivers an unexpected — potentially lethal — dose while staff and the pump display show the dose as correct (PH:4, AT:3, CH:4, SX:4). Execution complexity of assembling the full chain bounds exposure (EC:2 / EX:2).
• DATA_PRIVACY (privacy) path — CRITICAL. Models the same unauthenticated network position used to read the pump’s configuration, drug-library, and operational state (DP:3, PH:0, AT:2) — a reproducible read workflow that also supplies reconnaissance for the safety chain [4].

Both paths note evidence EV:3 (reproduced on real hardware by Trellix/McAfee ATR; no confirmed in-the-wild exploitation) and lifecycle state LS:PATCH_AVAILABLE (vendor fixed firmware for SpaceCom2 and Battery Pack SP with WiFi). Neither path receives a cap or systemic uplift, so both remain at their CRITICAL base band. The overall path_verdict is CRITICAL with SIDEWAYS direction — the two paths are co-dominant rather than one clearly subsuming the other.

7. Remediation & mitigations

• Apply B. Braun’s fixed “Update C” firmware — the specific, load-bearing fix for this bug: SpaceStation/SpaceCom2 011L000093; Battery Pack SP with WiFi 027L000093 / 053L000093; Data module compactplus I0050A0011 or later (equivalently SpaceCom2 012U000062+; also labeled SpaceCom L82+ / Battery Pack SP with WiFi L82+ / Data module compactplus A12+) [4][7]. The fixed firmware introduces the missing authenticity verification on critical data sets, which is the precise control absent in the vulnerable versions — with signature verification in place, an unsigned attacker-supplied configuration or drug library is rejected rather than accepted.
• Segment and isolate medical-device networks, restrict and monitor network access to the pumps, and do not expose these devices to the internet — per CISA/vendor guidance [3][4]. Because the attack requires a network foothold reachable by SpaceCom2, reducing that reachability directly reduces exposure to this specific unsigned-data write.
• Understand the one built-in limit and its boundary: because the malicious payload here is a configuration/drug-library upload, and the vendor states an upload cannot be done while a therapy is actively running, the write is confined to standby / powered-off states [4]. This narrows the window but does not eliminate exposure — standby remains fully exploitable, so it must not be relied on as a control.

8. Sources

1. NVD - CVE-2021-33885 - NIST NVD - https://nvd.nist.gov/vuln/detail/CVE-2021-33885 - authoritative CVE record: insufficient data-authenticity in SpaceCom2 before 012U000062, remote unauthenticated attacker sends malicious data used in place of correct data leading to full system command access, CVSS 9.8, CWE-347, affected models. - primary-advisory.
2. CVE-2021-33885 (MITRE / CVE.org record) - MITRE CVE.org - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33885 - canonical CVE description and identifier assignment (CNA-of-record). - primary-advisory.
3. B. Braun Infusomat Space Large Volume Pump (Update A) - ICSMA-21-294-01 - CISA - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-21-294-01 - government ICS-Medical advisory covering the full CVE set, per-CVE CVSS, affected/fixed versions, mitigation guidance. - primary-advisory.
4. 05/2021 SpaceCom, Battery Pack SP with WiFi, Data module compactplus - multiple vulnerabilities - B. Braun (vendor) - https://www.bbraun.com/en/products-and-solutions/b--braun-product-security/05-2021-spacecom--battery-pack-sp-with-wifi--data-module-compact.html - vendor advisory: six CVEs, CWE mappings, exact affected/fixed versions, standby-only upload constraint. - primary-advisory.
5. McAfee Enterprise ATR Uncovers Vulnerabilities in Globally Used B. Braun Infusion Pump - Trellix (formerly McAfee Enterprise ATR) - https://www.trellix.com/blogs/research/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/ - original researcher disclosure: five-bug chain, standby dose modification, zero-auth model, Jan 2021 timeline. - researcher-primary.
6. Overmedicated: Breaking the Security Barrier of a Globally Deployed Infusion Pump - Trellix Advanced Threat Research - https://www.trellix.com/blogs/research/overmedicated-breaking-the-security-barrier-of-a-globally-deployed-infusion-pump/ - Part 2 deep technical writeup: how the flaws chain into a working exploit on real hardware (reproducibility basis). - researcher-primary.
7. B. Braun Infusomat Pumps Could Let Attackers Remotely Alter Medication Dosages - The Hacker News - https://thehackernews.com/2021/08/bbraun-infusomat-pumps-could-let.html - press summary confirming keystone CVE, standby dose scenario, fixed-version labels, disclosure dates. - reputable-press.
8. Vulnerabilities Allow Hackers to Tamper With Doses Delivered by Medical Infusion Pumps - SecurityWeek - https://www.securityweek.com/vulnerabilities-allow-hackers-tamper-doses-delivered-medical-infusion-pumps/ - press coverage: remote unauthenticated dose tampering, researcher attribution, malfunction-masking safety consequence, SpaceCom-inactive-during-operation detail. - reputable-press.