[ { "schema_version": "1.1", "id": "CPATH-2026-0001", "slug": "qardio-arm-static-credentials", "title": "Qardio Arm — static credentials → engineering backdoor", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2025-20615" ], "vendor": "Qardio", "product": "Qardio Arm blood-pressure monitor + iOS app", "domain": "WEARABLE_HEALTH", "cvss": [ { "version": "v3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "source": "NVD" }, { "version": "v3.1", "score": 6.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "source": "CISA ICSMA-25-044-01" } ], "cvss_headline": { "version": "v3.1", "score": 6.6, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "account-authority" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "account-authority", "role": "dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:3/EC:4/EX:3/PH:0/DP:3/AT:3/CH:3/SR:4/SX:4/OR:3/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "The production secret can be read from an attacker-owned copy of the downloadable iOS app; no victim phone has to be seized.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A public app artifact yields a production credential, which bridges into the vendor API and then toward device command functions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires rotating the production secret and removing it from distributed app copies, followed by verification of dependent services.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "The production secret can be read from an attacker-owned copy of the downloadable iOS app; no victim phone has to be seized.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The engineering credential is stored in an application property list, so extraction is a direct file-inspection task.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Reading the credential does not itself change blood-pressure measurement or cause a physical effect; BLE command delivery is a separate downstream step.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed value is a production engineering credential, not ordinary app telemetry or a single user record.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A public app artifact yields a production credential, which bridges into the vendor API and then toward device command functions.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same static credential is embedded in every downloadable app copy, so one extraction produces a portable secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The engineering account is reusable across the deployed service without repeating extraction for each user, while BLE delivery remains local.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires rotating the production secret and removing it from distributed app copies, followed by verification of dependent services.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20615", "publisher": "NVD", "kind": "advisory" }, { "id": "cisa-icsma-25-044-01", "label": "CISA ICSMA-25-044-01", "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01", "publisher": "CISA", "kind": "advisory" } ], "dominant_paths": [ { "id": "account-authority", "role": "dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:3/EC:4/EX:3/PH:0/DP:3/AT:3/CH:3/SR:4/SX:4/OR:3/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "The production secret can be read from an attacker-owned copy of the downloadable iOS app; no victim phone has to be seized.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A public app artifact yields a production credential, which bridges into the vendor API and then toward device command functions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires rotating the production secret and removing it from distributed app copies, followed by verification of dependent services.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "The production secret can be read from an attacker-owned copy of the downloadable iOS app; no victim phone has to be seized.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The engineering credential is stored in an application property list, so extraction is a direct file-inspection task.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Reading the credential does not itself change blood-pressure measurement or cause a physical effect; BLE command delivery is a separate downstream step.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed value is a production engineering credential, not ordinary app telemetry or a single user record.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A public app artifact yields a production credential, which bridges into the vendor API and then toward device command functions.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same static credential is embedded in every downloadable app copy, so one extraction produces a portable secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The engineering account is reusable across the deployed service without repeating extraction for each user, while BLE delivery remains local.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires rotating the production secret and removing it from distributed app copies, followed by verification of dependent services.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The secret opens an engineering account and a backdoor capable of issuing raw commands to Qardio Arm devices." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0001" }, { "schema_version": "1.1", "id": "CPATH-2026-0002", "slug": "baxter-life2000-insufficient-logging", "title": "Baxter Life2000 — insufficient audit logging", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-48967" ], "vendor": "Baxter (vendor self-disclosure)", "product": "Baxter Life2000 Ventilation System + Service PC", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "source": "Baxter/Product Security via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 10, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "MONITOR", "direction": "OVER", "requirements_missed": [ 5 ], "review": { "state": "provisional", "summary": "Source-backed logging deficiency with a model-reviewed no-reachability boundary; independent operational review remains open." }, "dominant_path_ids": [ "observability-recovery-only" ], "dominance_reason": "Observability and recovery is the only modeled consequence because insufficient logging creates no independent exploit primitive or reachable authority; MONITOR is therefore explicit, not an array-order default.", "paths": [ { "id": "observability-recovery-only", "role": "dominant", "terminal_type": "OBSERVABILITY_RECOVERY_ONLY", "family": "recovery", "label": "Observability and recovery", "summary": "An audit-logging gap constrains detection and recovery after a separate compromise; it creates no exploit path by itself.", "band": "MONITOR", "vector": "CPATH:1.0-candidate/TT:OBSERVABILITY_RECOVERY_ONLY/RE:0/EC:0/EX:0/PH:0/DP:0/AT:0/CH:1/SR:0/SX:3/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "documented-logging-gap", "kind": "boundary", "label": "Documented logging gap", "claim": "The NVD and CISA advisories identify insufficient audit logging; the absence of adequate security-event records affects the Life2000 system and its Service PC.", "basis": "source", "evidence_refs": [ "nvd", "cisa-icsma-24-319-01" ] }, { "id": "no-exploit-primitive", "kind": "boundary", "label": "No new reachability", "claim": "Insufficient logging does not create an exploit primitive, device reachability, execution capability, or authority. The vector therefore records RE=0, EC=0, PH=0, DP=0, and AT=0.", "basis": "model-inference", "evidence_refs": [] }, { "id": "dependent-condition", "kind": "transition", "label": "Depends on another compromise", "claim": "The observability consequence materializes only after a separate compromise or operational failure produces events that defenders need to detect and reconstruct.", "basis": "model-inference", "evidence_refs": [] }, { "id": "detection-forensics-consequence", "kind": "consequence", "label": "Detection and forensic recovery", "claim": "Missing audit evidence can delay detection, prevent reliable forensic reconstruction, and make recovery verification less certain after that separate compromise.", "basis": "model-inference", "evidence_refs": [] }, { "id": "remediation-boundary", "kind": "recovery", "label": "Restore observability", "claim": "The patch-available liveness state and OR=3 assumption model vendor remediation plus per-device verification of restored logging; they do not imply that an attacker reached the device.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "No independent access path", "detail": "Missing audit records create no route into the Life2000 ventilator or Service PC; another vulnerability must provide access first.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "No executable action", "detail": "There is no attacker action that executes a missing log, so execution complexity is not applicable as an exploit property.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "For Baxter Life2000 Ventilation System + Service PC, the documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Insufficient logging does not change ventilation therapy or device behavior by itself.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "The logging gap does not independently disclose patient, credential, or device data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "No authority gained", "detail": "No account, service, firmware, or command authority follows from the absence of an audit event.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Single bounded transition", "detail": "The gap matters only after a separate compromise, when missing records weaken the investigation of that other path.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "No reusable exploit", "detail": "No reusable attack primitive is created; the same control deficiency may recur, but recurrence is not exploit reuse.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The operational impact can appear across multiple installations that lack adequate logs, even though no independent attack executes through it.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Missing audit evidence delays detection, makes incident reconstruction less reliable, and can complicate recovery after a separate compromise.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions. This status is recorded for Baxter Life2000 Ventilation System + Service PC.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "MONITOR", "adjustment": "none", "reason": "The MONITOR base band remains final because no separate cap or systemic uplift applies. Insufficient logging does not change ventilation therapy or device behavior by itself." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48967", "publisher": "NVD", "kind": "advisory" }, { "id": "cisa-icsma-24-319-01", "label": "CISA ICSMA-24-319-01", "url": "https://www.cisa.gov/news-events/ics-medical-advisories", "publisher": "CISA", "kind": "advisory" } ], "dominant_paths": [ { "id": "observability-recovery-only", "role": "dominant", "terminal_type": "OBSERVABILITY_RECOVERY_ONLY", "family": "recovery", "label": "Observability and recovery", "summary": "An audit-logging gap constrains detection and recovery after a separate compromise; it creates no exploit path by itself.", "band": "MONITOR", "vector": "CPATH:1.0-candidate/TT:OBSERVABILITY_RECOVERY_ONLY/RE:0/EC:0/EX:0/PH:0/DP:0/AT:0/CH:1/SR:0/SX:3/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "documented-logging-gap", "kind": "boundary", "label": "Documented logging gap", "claim": "The NVD and CISA advisories identify insufficient audit logging; the absence of adequate security-event records affects the Life2000 system and its Service PC.", "basis": "source", "evidence_refs": [ "nvd", "cisa-icsma-24-319-01" ] }, { "id": "no-exploit-primitive", "kind": "boundary", "label": "No new reachability", "claim": "Insufficient logging does not create an exploit primitive, device reachability, execution capability, or authority. The vector therefore records RE=0, EC=0, PH=0, DP=0, and AT=0.", "basis": "model-inference", "evidence_refs": [] }, { "id": "dependent-condition", "kind": "transition", "label": "Depends on another compromise", "claim": "The observability consequence materializes only after a separate compromise or operational failure produces events that defenders need to detect and reconstruct.", "basis": "model-inference", "evidence_refs": [] }, { "id": "detection-forensics-consequence", "kind": "consequence", "label": "Detection and forensic recovery", "claim": "Missing audit evidence can delay detection, prevent reliable forensic reconstruction, and make recovery verification less certain after that separate compromise.", "basis": "model-inference", "evidence_refs": [] }, { "id": "remediation-boundary", "kind": "recovery", "label": "Restore observability", "claim": "The patch-available liveness state and OR=3 assumption model vendor remediation plus per-device verification of restored logging; they do not imply that an attacker reached the device.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "No independent access path", "detail": "Missing audit records create no route into the Life2000 ventilator or Service PC; another vulnerability must provide access first.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "No executable action", "detail": "There is no attacker action that executes a missing log, so execution complexity is not applicable as an exploit property.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "For Baxter Life2000 Ventilation System + Service PC, the documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Insufficient logging does not change ventilation therapy or device behavior by itself.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "The logging gap does not independently disclose patient, credential, or device data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "No authority gained", "detail": "No account, service, firmware, or command authority follows from the absence of an audit event.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Single bounded transition", "detail": "The gap matters only after a separate compromise, when missing records weaken the investigation of that other path.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "No reusable exploit", "detail": "No reusable attack primitive is created; the same control deficiency may recur, but recurrence is not exploit reuse.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The operational impact can appear across multiple installations that lack adequate logs, even though no independent attack executes through it.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Missing audit evidence delays detection, makes incident reconstruction less reliable, and can complicate recovery after a separate compromise.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions. This status is recorded for Baxter Life2000 Ventilation System + Service PC.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "MONITOR", "adjustment": "none", "reason": "The MONITOR base band remains final because no separate cap or systemic uplift applies. Insufficient logging does not change ventilation therapy or device behavior by itself." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0002" }, { "schema_version": "1.1", "id": "CPATH-2026-0003", "slug": "contec-cms8000-firmware-backdoor", "title": "Contec CMS8000 — unsigned-firmware load / hard-coded beacon", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2025-0626", "CVE-2025-0683" ], "vendor": "Contec (also sold under rebrands)", "product": "Contec CMS8000 patient monitor", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v4.0", "score": 7.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "CISA/ICS-CERT via NVD (CVE-2025-0626)" }, { "version": "v3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "source": "CISA/ICS-CERT via NVD (CVE-2025-0626)" }, { "version": "v4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "CISA/ICS-CERT via NVD (CVE-2025-0683)" }, { "version": "v3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "source": "CISA/ICS-CERT via NVD (CVE-2025-0683)" } ], "cvss_headline": { "version": "v4.0", "score": 8.2, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "firmware-trust-root", "device-control-safety", "data-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:2/EC:3/EX:2/PH:4/DP:3/AT:4/CH:4/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The monitor connects to a hard-coded routable NFS host, so exploitation depends on controlling or intercepting that network position.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The default NFS fetch bridges a network host into persistent code execution and then into clinical monitoring behavior.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Firmware trust root", "claim": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The absence of a signed update path means recovery must replace or verify firmware across affected devices rather than apply a simple configuration change.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The monitor connects to a hard-coded routable NFS host, so exploitation depends on controlling or intercepting that network position.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Serving a compatible replacement binary is reproducible, but requires understanding the NFS layout and expected executable format.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Code loaded as monitor firmware can suppress alarms or falsify patient state, creating a credible wrong-care pathway without claiming observed injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Firmware-level code can read sensitive patient and operational state handled by the monitor.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The default NFS fetch bridges a network host into persistent code execution and then into clinical monitoring behavior.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same hard-coded host and unsigned load design is shared across affected CMS8000 units and rebrands.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "An attacker with the required network position can repeat the replacement across reachable monitors, but setup is deployment-dependent.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The absence of a signed update path means recovery must replace or verify firmware across affected devices rather than apply a simple configuration change.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "CISA ICSMA-25-030-01 supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:3/EX:2/PH:4/DP:4/AT:3/CH:4/SR:4/SX:3/OR:4/EV:2/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Control begins when a monitor reaches the hard-coded NFS address and accepts content from an attacker-controlled or intercepted endpoint.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Network content becomes executable monitor behavior and then influences a clinical perception-to-care boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Restoring confidence requires verified firmware across the installed base because ordinary updates do not establish signed provenance.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Control begins when a monitor reaches the hard-coded NFS address and accepts content from an attacker-controlled or intercepted endpoint.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The attacker must prepare monitor-compatible code and gain the required network position, a standard but deliberate exploitation workflow.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The manipulated patient-monitoring state is perception data that can directly shape clinical decisions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Executed replacement code can control monitor software and alarm behavior, though this path distinguishes device command authority from the signing root itself.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Network content becomes executable monitor behavior and then influences a clinical perception-to-care boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same insecure loading behavior is present across the affected product family, making the technique portable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Multiple reachable monitors can be targeted after deployment-specific network positioning, rather than through a universal internet endpoint.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Restoring confidence requires verified firmware across the installed base because ordinary updates do not establish signed provenance.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "CISA ICSMA-25-030-01 reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:4/EX:4/PH:0/DP:3/AT:2/CH:3/SR:4/SX:4/OR:3/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The monitor sends plaintext patient information to a hard-coded routable address by default, exposing the flow wherever that route can be observed or controlled.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A default device configuration moves clinical data across the monitor and network boundary to an external host.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires changing the destination and validating network and device configuration across deployed monitors.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The monitor sends plaintext patient information to a hard-coded routable address by default, exposing the flow wherever that route can be observed or controlled.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EC": { "label": "Straightforward operation", "detail": "Receiving or observing the default plaintext beacon is straightforward once the network path is available.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The same channel carries clinical state used in care, but this privacy path does not assert that disclosure alone caused patient harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Receiving the beacon grants bounded access to exported data, not administrative control of the monitor or its firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A default device configuration moves clinical data across the monitor and network boundary to an external host.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The destination and beacon behavior are shared across affected monitors, so the collection method can be reused.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Plaintext egress can be collected across reachable units without interacting with each patient interface separately.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires changing the destination and validating network and device configuration across deployed monitors.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "CISA ICSMA-25-030-01 supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry." } } ], "sources": [ { "id": "cisa-icsma-25-030-01", "label": "CISA ICSMA-25-030-01", "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01", "publisher": "CISA", "kind": "advisory" }, { "id": "claroty-team82", "label": "Claroty Team82", "url": "https://claroty.com/team82/research/are-contec-cms8000-patient-monitors-infected-with-a-chinese-backdoor-the-reality-is-more-complicated", "publisher": "Claroty Team82", "kind": "other" }, { "id": "nvd-cve-2025-0626", "label": "NVD CVE-2025-0626", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0626", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:2/EC:3/EX:2/PH:4/DP:3/AT:4/CH:4/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The monitor connects to a hard-coded routable NFS host, so exploitation depends on controlling or intercepting that network position.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The default NFS fetch bridges a network host into persistent code execution and then into clinical monitoring behavior.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Firmware trust root", "claim": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The absence of a signed update path means recovery must replace or verify firmware across affected devices rather than apply a simple configuration change.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The monitor connects to a hard-coded routable NFS host, so exploitation depends on controlling or intercepting that network position.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Serving a compatible replacement binary is reproducible, but requires understanding the NFS layout and expected executable format.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Code loaded as monitor firmware can suppress alarms or falsify patient state, creating a credible wrong-care pathway without claiming observed injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Firmware-level code can read sensitive patient and operational state handled by the monitor.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The default NFS fetch bridges a network host into persistent code execution and then into clinical monitoring behavior.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same hard-coded host and unsigned load design is shared across affected CMS8000 units and rebrands.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "An attacker with the required network position can repeat the replacement across reachable monitors, but setup is deployment-dependent.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The absence of a signed update path means recovery must replace or verify firmware across affected devices rather than apply a simple configuration change.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "CISA ICSMA-25-030-01 supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unsigned binaries copied into the executable directory run as trusted monitor code beneath normal application controls." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:3/EX:2/PH:4/DP:4/AT:3/CH:4/SR:4/SX:3/OR:4/EV:2/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Control begins when a monitor reaches the hard-coded NFS address and accepts content from an attacker-controlled or intercepted endpoint.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Network content becomes executable monitor behavior and then influences a clinical perception-to-care boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Restoring confidence requires verified firmware across the installed base because ordinary updates do not establish signed provenance.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Control begins when a monitor reaches the hard-coded NFS address and accepts content from an attacker-controlled or intercepted endpoint.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The attacker must prepare monitor-compatible code and gain the required network position, a standard but deliberate exploitation workflow.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The manipulated patient-monitoring state is perception data that can directly shape clinical decisions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Executed replacement code can control monitor software and alarm behavior, though this path distinguishes device command authority from the signing root itself.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Network content becomes executable monitor behavior and then influences a clinical perception-to-care boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same insecure loading behavior is present across the affected product family, making the technique portable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Multiple reachable monitors can be targeted after deployment-specific network positioning, rather than through a universal internet endpoint.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Restoring confidence requires verified firmware across the installed base because ordinary updates do not establish signed provenance.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "CISA ICSMA-25-030-01 reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Malicious monitor code can falsify displayed vitals or suppress alarms that clinicians use, supporting a serious safety consequence without proving field harm." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:4/EX:4/PH:0/DP:3/AT:2/CH:3/SR:4/SX:4/OR:3/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The monitor sends plaintext patient information to a hard-coded routable address by default, exposing the flow wherever that route can be observed or controlled.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A default device configuration moves clinical data across the monitor and network boundary to an external host.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires changing the destination and validating network and device configuration across deployed monitors.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The monitor sends plaintext patient information to a hard-coded routable address by default, exposing the flow wherever that route can be observed or controlled.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EC": { "label": "Straightforward operation", "detail": "Receiving or observing the default plaintext beacon is straightforward once the network path is available.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The same channel carries clinical state used in care, but this privacy path does not assert that disclosure alone caused patient harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Receiving the beacon grants bounded access to exported data, not administrative control of the monitor or its firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A default device configuration moves clinical data across the monitor and network boundary to an external host.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The destination and beacon behavior are shared across affected monitors, so the collection method can be reused.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Plaintext egress can be collected across reachable units without interacting with each patient interface separately.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires changing the destination and validating network and device configuration across deployed monitors.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "CISA ICSMA-25-030-01 supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "cisa-icsma-25-030-01" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The beacon contains patient health information rather than low-sensitivity diagnostics or generic device telemetry." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0003" }, { "schema_version": "1.1", "id": "CPATH-2026-0004", "slug": "baxter-life2000-internal-jtag-flash-r-w", "title": "Baxter Life2000 internal JTAG flash R/W", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-48970" ], "vendor": "Baxter", "product": "Baxter Life2000 internal JTAG flash R/W", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "source": "Baxter/Product Security via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.3, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "SIDEWAYS", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "firmware-trust-root" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:1/EC:3/EX:1/PH:4/DP:3/AT:3/CH:3/SR:4/SX:1/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "Internal JTAG header requires opening the device, board-level access, per-device.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Chains physical access into safety actuation across boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistent and hard to detect, needs field service.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "Internal JTAG header requires opening the device, board-level access, per-device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Changing therapy behavior requires more than dumping flash: the attacker must prepare and install a deliberate firmware or control modification.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Modified device code can expose ventilator settings and other sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Flash modification provides device-command and firmware authority, but it does not expose a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Chains physical access into safety actuation across boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The technique and any extracted secrets are reusable across the model.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Strictly per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistent and hard to detect, needs field service.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury." } }, { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:1/EC:4/EX:1/PH:3/DP:3/AT:4/CH:4/SR:4/SX:1/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "An attacker must open each ventilator and attach to its internal JTAG header; the interface is neither remotely nor wirelessly reachable.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Physical JTAG access crosses into firmware authority and then device control; extracted knowledge or secrets can be reused across units.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Firmware trust root", "claim": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistent, hard to detect, requires field service to recover.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "An attacker must open each ventilator and attach to its internal JTAG header; the interface is neither remotely nor wirelessly reachable.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Once a JTAG connection is established, one hardware-debugging tool can read or write the flash.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Firmware compromise can alter therapy-control behavior and reduce the ventilator’s safety margin.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Flash contents can expose proprietary firmware and embedded cryptographic secrets.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Physical JTAG access crosses into firmware authority and then device control; extracted knowledge or secrets can be reused across units.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Extracted firmware and embedded keys can be reused across devices in the same product line.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Each device must be physically opened.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistent, hard to detect, requires field service to recover.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48970", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:1/EC:3/EX:1/PH:4/DP:3/AT:3/CH:3/SR:4/SX:1/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "Internal JTAG header requires opening the device, board-level access, per-device.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Chains physical access into safety actuation across boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistent and hard to detect, needs field service.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "Internal JTAG header requires opening the device, board-level access, per-device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Changing therapy behavior requires more than dumping flash: the attacker must prepare and install a deliberate firmware or control modification.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Modified device code can expose ventilator settings and other sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Flash modification provides device-command and firmware authority, but it does not expose a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Chains physical access into safety actuation across boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The technique and any extracted secrets are reusable across the model.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Strictly per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistent and hard to detect, needs field service.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Direct flash modification can alter ventilator therapy or disable life-support behavior, creating a credible risk of serious patient injury." } }, { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:1/EC:4/EX:1/PH:3/DP:3/AT:4/CH:4/SR:4/SX:1/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "An attacker must open each ventilator and attach to its internal JTAG header; the interface is neither remotely nor wirelessly reachable.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Physical JTAG access crosses into firmware authority and then device control; extracted knowledge or secrets can be reused across units.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Firmware trust root", "claim": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistent, hard to detect, requires field service to recover.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "An attacker must open each ventilator and attach to its internal JTAG header; the interface is neither remotely nor wirelessly reachable.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Once a JTAG connection is established, one hardware-debugging tool can read or write the flash.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Firmware compromise can alter therapy-control behavior and reduce the ventilator’s safety margin.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Flash contents can expose proprietary firmware and embedded cryptographic secrets.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Physical JTAG access crosses into firmware authority and then device control; extracted knowledge or secrets can be reused across units.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Extracted firmware and embedded keys can be reused across devices in the same product line.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Each device must be physically opened.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistent, hard to detect, requires field service to recover.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Read and write access to internal flash lets an attacker replace trusted device code and take control beneath the application layer." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0004" }, { "schema_version": "1.1", "id": "CPATH-2026-0005", "slug": "baxter-life2000-hard-coded-clinician-credentials", "title": "Baxter Life2000 hard-coded clinician credentials", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-48971" ], "vendor": "Baxter", "product": "Baxter Life2000 hard-coded clinician credentials", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "source": "Baxter/Product Security via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.3, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "SIDEWAYS", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "account-authority" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "device-control-safety", "role": "supporting", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Clinician-level setting changes can alter ventilator therapy and reduce patient safety margins, even without operating-system or firmware control.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:4/EX:2/PH:3/DP:3/AT:3/CH:4/SR:4/SX:2/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Using the recovered clinician credential against a ventilator requires local or serial access to that target device.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses credential to device to physical and safety domains.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "Clinician-level setting changes can alter ventilator therapy and reduce patient safety margins, even without operating-system or firmware control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Clinician-level setting changes can alter ventilator therapy and reduce patient safety margins, even without operating-system or firmware control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Unfixable secret without firmware update; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Using the recovered clinician credential against a ventilator requires local or serial access to that target device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "After the shared clinician credential is accepted, changing therapy settings uses the ventilator's ordinary clinical workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Clinician-level setting changes can alter ventilator therapy and reduce patient safety margins, even without operating-system or firmware control.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The clinician interface exposes therapy settings and sensitive device state, but not a broader patient-record store.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The clinician account can change therapy settings and device operation, but it does not provide firmware-signing or operating-system root authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses credential to device to physical and safety domains.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The hard-coded credential can be reused across affected ventilators that share the same implementation.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each use still requires access to an individual ventilator; the weakness does not provide a fleet execution channel.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Unfixable secret without firmware update; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Clinician-level setting changes can alter ventilator therapy and reduce patient safety margins, even without operating-system or firmware control." } }, { "id": "account-authority", "role": "dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:3/EC:4/EX:3/PH:3/DP:3/AT:2/CH:4/SR:4/SX:3/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "The hard-coded clinician and serial-number credentials can be recovered from an attacker-owned device or firmware copy without touching a victim device.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The recovered shared secret bridges from device-extraction to a reusable authority across the fleet.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "A hard-coded secret cannot be rotated without firmware update across the fleet; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "The hard-coded clinician and serial-number credentials can be recovered from an attacker-owned device or firmware copy without touching a victim device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Extraction is straightforward once firmware and device available.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "The shared clinician credential can authorize changes to ventilator therapy settings, so compromise can reach a severe therapy consequence even though this path ends at account authority.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed clinician credential is a reusable security secret rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The recovered shared secret bridges from device-extraction to a reusable authority across the fleet.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The credential is shared and hard-coded across the entire fleet (portable secret).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Reusable deployment-wide but each device still needs local and serial access to apply.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "A hard-coded secret cannot be rotated without firmware update across the fleet; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48971", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "account-authority", "role": "dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:3/EC:4/EX:3/PH:3/DP:3/AT:2/CH:4/SR:4/SX:3/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "The hard-coded clinician and serial-number credentials can be recovered from an attacker-owned device or firmware copy without touching a victim device.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The recovered shared secret bridges from device-extraction to a reusable authority across the fleet.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "A hard-coded secret cannot be rotated without firmware update across the fleet; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "The hard-coded clinician and serial-number credentials can be recovered from an attacker-owned device or firmware copy without touching a victim device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Extraction is straightforward once firmware and device available.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "The shared clinician credential can authorize changes to ventilator therapy settings, so compromise can reach a severe therapy consequence even though this path ends at account authority.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed clinician credential is a reusable security secret rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The recovered shared secret bridges from device-extraction to a reusable authority across the fleet.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The credential is shared and hard-coded across the entire fleet (portable secret).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Reusable deployment-wide but each device still needs local and serial access to apply.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "A hard-coded secret cannot be rotated without firmware update across the fleet; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The credential opens a clinician account that can change therapy settings, but it does not grant operating-system root or firmware-signing authority." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0005" }, { "schema_version": "1.1", "id": "CPATH-2026-0006", "slug": "contec-cms8000-out-of-bounds-write-via", "title": "Contec CMS8000 out-of-bounds write via UDP", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-12248" ], "vendor": "Contec", "product": "Contec CMS8000 out-of-bounds write via UDP", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "CISA/ICS-CERT via NVD" }, { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "CISA/ICS-CERT via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.8, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "device-availability" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:3/EX:3/PH:4/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Single unauthenticated UDP datagram, network-reachable (the same local network and on-path) is default and internet-style exposure.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A network packet crosses into code execution in the monitor process and then into the clinical display and alarm functions used for care.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "No patch, CISA says remove from network to fleet-level remediation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Single unauthenticated UDP datagram, network-reachable (the same local network and on-path) is default and internet-style exposure.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Out-of-bounds write with controllable offset, without authentication and handshake — standard researcher exploitation workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Vitals are health and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Code execution in monolithic root monitor process is full device-control and administrator command authority, but not a signing and firmware-update and trust-root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A network packet crosses into code execution in the monitor process and then into the clinical display and alarm functions used for care.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Identical firmware across all units and rebrands.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remotely reachable on a flat network, no per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "No patch, CISA says remove from network to fleet-level remediation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same remote code-execution primitive applies across affected monitors and CISA’s removal guidance makes recovery a fleet-wide operational action." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:4/EX:4/PH:2/DP:0/AT:2/CH:3/SR:4/SX:4/OR:4/EV:2/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The malformed network request can reach any affected monitor whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Contributes to a denial chain and crosses network to device boundary but is less of a reusable cross-domain authority bridge than full remote code execution.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "No patch, removal from network required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The malformed network request can reach any affected monitor whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One malformed UDP datagram can crash or hang the monolithic monitor process; reliable code execution is not required for this availability path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "A crash exposes no data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Crashing the process is bounded component and session disruption, not configuration and command authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Contributes to a denial chain and crosses network to device boundary but is less of a reusable cross-domain authority bridge than full remote code execution.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same request can be reused across affected monitors that run the vulnerable service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remote, fleet-scale on flat network.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "No patch, removal from network required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12248", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:3/EX:3/PH:4/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Single unauthenticated UDP datagram, network-reachable (the same local network and on-path) is default and internet-style exposure.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A network packet crosses into code execution in the monitor process and then into the clinical display and alarm functions used for care.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "No patch, CISA says remove from network to fleet-level remediation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Single unauthenticated UDP datagram, network-reachable (the same local network and on-path) is default and internet-style exposure.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Out-of-bounds write with controllable offset, without authentication and handshake — standard researcher exploitation workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Remote code execution on the monitor can falsify displayed vitals or suppress alarms, creating a credible missed-event or wrong-treatment risk.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Vitals are health and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Code execution in monolithic root monitor process is full device-control and administrator command authority, but not a signing and firmware-update and trust-root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A network packet crosses into code execution in the monitor process and then into the clinical display and alarm functions used for care.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Identical firmware across all units and rebrands.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remotely reachable on a flat network, no per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "No patch, CISA says remove from network to fleet-level remediation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same remote code-execution primitive applies across affected monitors and CISA’s removal guidance makes recovery a fleet-wide operational action." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:4/EX:4/PH:2/DP:0/AT:2/CH:3/SR:4/SX:4/OR:4/EV:2/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The malformed network request can reach any affected monitor whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Contributes to a denial chain and crosses network to device boundary but is less of a reusable cross-domain authority bridge than full remote code execution.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "No patch, removal from network required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The malformed network request can reach any affected monitor whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One malformed UDP datagram can crash or hang the monolithic monitor process; reliable code execution is not required for this availability path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "A crash exposes no data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Crashing the process is bounded component and session disruption, not configuration and command authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Contributes to a denial chain and crosses network to device boundary but is less of a reusable cross-domain authority bridge than full remote code execution.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same request can be reused across affected monitors that run the vulnerable service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remote, fleet-scale on flat network.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "No patch, removal from network required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Taking a monitor offline interrupts surveillance and alarm workflows; staff can detect the outage, so this is degraded monitoring rather than attacker-directed therapy." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0006" }, { "schema_version": "1.1", "id": "CPATH-2026-0007", "slug": "qardio-ble-unauthenticated-dos-startmeasurement-flood", "title": "Qardio BLE unauthenticated DoS (startMeasurement flood)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2025-24836" ], "vendor": "Qardio", "product": "Qardio BLE unauthenticated DoS (startMeasurement flood)", "domain": "WEARABLE_HEALTH", "cvss": [ { "version": "v4.0", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "CISA/ICS-CERT via NVD" }, { "version": "v3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H", "source": "CISA/ICS-CERT via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 7.1, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "ELEVATED", "direction": "OVER", "requirements_missed": [ 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-availability" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, ELEVATED.", "paths": [ { "id": "device-availability", "role": "dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "band": "ELEVATED", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:2/EC:4/EX:2/PH:2/DP:1/AT:2/CH:1/SR:3/SX:2/OR:1/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "BLE proximity (~10m), no pairing and auth (local-net and proximity position).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Single bounded transition", "claim": "Limited chaining - crosses physical and device boundary but does not transfer authority across domains.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Routine local recovery", "claim": "User-visible, recoverable by disconnect and battery removal, no fleet action.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "BLE proximity (~10m), no pairing and auth (local-net and proximity position).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A short BLE script can connect and repeatedly invoke the measurement command; no memory-corruption exploit or paired session is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "Minor and low-sensitivity data exposure.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded command authority over the cuff (startMeasurement) - no administrator and firmware and trust-root control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Single bounded transition", "detail": "Limited chaining - crosses physical and device boundary but does not transfer authority across domains.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The unauthenticated-write method and script is portable and reusable across any unit.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each request flood requires Bluetooth proximity to one target device; it cannot execute remotely across a fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Routine local recovery", "detail": "User-visible, recoverable by disconnect and battery removal, no fleet action.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "ELEVATED", "adjustment": "none", "reason": "The ELEVATED base band remains final because no separate cap or systemic uplift applies. Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24836", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-availability", "role": "dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "band": "ELEVATED", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:2/EC:4/EX:2/PH:2/DP:1/AT:2/CH:1/SR:3/SX:2/OR:1/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "BLE proximity (~10m), no pairing and auth (local-net and proximity position).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Single bounded transition", "claim": "Limited chaining - crosses physical and device boundary but does not transfer authority across domains.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Routine local recovery", "claim": "User-visible, recoverable by disconnect and battery removal, no fleet action.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "BLE proximity (~10m), no pairing and auth (local-net and proximity position).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A short BLE script can connect and repeatedly invoke the measurement command; no memory-corruption exploit or paired session is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "Minor and low-sensitivity data exposure.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded command authority over the cuff (startMeasurement) - no administrator and firmware and trust-root control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Single bounded transition", "detail": "Limited chaining - crosses physical and device boundary but does not transfer authority across domains.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The unauthenticated-write method and script is portable and reusable across any unit.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each request flood requires Bluetooth proximity to one target device; it cannot execute remotely across a fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Routine local recovery", "detail": "User-visible, recoverable by disconnect and battery removal, no fleet action.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "ELEVATED", "adjustment": "none", "reason": "The ELEVATED base band remains final because no separate cap or systemic uplift applies. Repeated unauthenticated measurement commands can force cuff inflation and block legitimate readings, causing discomfort and a bounded monitoring outage rather than severe injury." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0007" }, { "schema_version": "1.1", "id": "CPATH-2026-0008", "slug": "qardio-firmware-files-extractable", "title": "Qardio firmware files extractable", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2025-23421" ], "vendor": "Qardio", "product": "Qardio firmware files extractable", "domain": "WEARABLE_HEALTH", "cvss": [ { "version": "v4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "CISA/ICS-CERT via NVD" }, { "version": "v3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "source": "CISA/ICS-CERT via NVD" } ], "cvss_headline": { "version": "v4.0", "score": 6.9, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "HIGH", "direction": "UNDER", "requirements_missed": [ 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "data-privacy" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, HIGH.", "paths": [ { "id": "data-privacy", "role": "dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:3/EC:4/EX:3/PH:0/DP:3/AT:1/CH:2/SR:3/SX:3/OR:1/EV:2/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "An attacker can obtain the firmware files through their own copy of the companion app or update flow; no access to a victim device is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Enables further reverse engineering across app and firmware boundary but is not a multi-hop reusable authority bridge by itself.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Routine local recovery", "claim": "Low recovery burden (no key rotation or recall needed for the extraction itself).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "An attacker can obtain the firmware files through their own copy of the companion app or update flow; no access to a victim device is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Straightforward extraction, single operation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "No direct safety effect from mere extraction.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Read-only or preparatory access", "detail": "No direct authority gained.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Enables further reverse engineering across app and firmware boundary but is not a multi-hop reusable authority bridge by itself.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The extracted artifact is portable across devices that share the same firmware image.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Deployment-wide once the technique is set up, but each victim's data is not remotely harvested - it is the common firmware that is exposed.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Routine local recovery", "detail": "Low recovery burden (no key rotation or recall needed for the extraction itself).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23421", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "data-privacy", "role": "dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:3/EC:4/EX:3/PH:0/DP:3/AT:1/CH:2/SR:3/SX:3/OR:1/EV:2/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "An attacker can obtain the firmware files through their own copy of the companion app or update flow; no access to a victim device is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Enables further reverse engineering across app and firmware boundary but is not a multi-hop reusable authority bridge by itself.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Routine local recovery", "claim": "Low recovery burden (no key rotation or recall needed for the extraction itself).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "An attacker can obtain the firmware files through their own copy of the companion app or update flow; no access to a victim device is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Straightforward extraction, single operation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "No direct safety effect from mere extraction.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Read-only or preparatory access", "detail": "No direct authority gained.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Enables further reverse engineering across app and firmware boundary but is not a multi-hop reusable authority bridge by itself.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The extracted artifact is portable across devices that share the same firmware image.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Deployment-wide once the technique is set up, but each victim's data is not remotely harvested - it is the common firmware that is exposed.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Routine local recovery", "detail": "Low recovery burden (no key rotation or recall needed for the extraction itself).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Extracted firmware exposes proprietary device logic and operational control data rather than ordinary personal information." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0008" }, { "schema_version": "1.1", "id": "CPATH-2026-0009", "slug": "swisslog-translogic-pts-unsigned-firmware-update", "title": "Swisslog Translogic PTS unsigned firmware update", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2021-37160" ], "vendor": "Swisslog", "product": "Swisslog Translogic PTS unsigned firmware update", "domain": "GENERAL_IOT", "cvss": [ { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.8, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "firmware-trust-root", "fleet-control-plane" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "A network update that does not verify signatures can replace the station's trusted firmware and persist beneath application-level controls.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:4/EC:4/EX:4/PH:3/DP:3/AT:4/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "network-update", "kind": "access", "label": "Network update accepts unsigned firmware", "claim": "The cited station update path is network-reachable without authentication and does not require a valid firmware signature.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "upload-barrier", "kind": "boundary", "label": "Protocol knowledge is the main upload barrier", "claim": "Once an attacker can speak the update protocol, no cryptographic signature check remains to reject the uploaded image, making the network operation straightforward.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "firmware-execution", "kind": "capability", "label": "Uploaded code becomes station firmware", "claim": "An accepted image executes below ordinary application controls and replaces the code the station treats as trusted firmware.", "basis": "model-inference", "evidence_refs": [] }, { "id": "trust-root-loss", "kind": "consequence", "label": "Firmware trust is no longer defensible", "claim": "The station can no longer distinguish vendor-authorized firmware from attacker code, giving the replacement image persistent control over station behavior. No field exploitation or patient harm is asserted.", "basis": "model-inference", "evidence_refs": [] }, { "id": "restore-trust", "kind": "recovery", "label": "Trust must be re-established across the deployment", "claim": "Recovery is modeled as verifying or reprovisioning affected stations with a signature-enforcing trust root, not merely restarting the application.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Remote station access", "detail": "NVD classifies the path as network-accessible with no privileges required, so an attacker does not need local contact with a station.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "No signature barrier", "detail": "The update path does not require a valid vendor signature; after the protocol is understood, no cryptographic check blocks the upload.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort are both unrestricted", "detail": "Exposure remains at the shared upper bound because remote reachability and low execution effort support the same conclusion.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Transport disruption can narrow clinical safety margins", "detail": "Stations move blood, medication, and specimens; unsafe routing or stoppage is treated as safety-significant, although this record documents no patient harm.", "basis": "operational-assumption", "evidence_refs": [] }, "DP": { "label": "Firmware and device state are exposed", "detail": "Replacement firmware can observe or alter proprietary station state, but the path does not depend on falsified perception directly driving a safety decision.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware becomes the highest device authority", "detail": "Code installed as trusted firmware can persist beneath application permissions and govern the station's core behavior.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One upload crosses multiple control layers", "detail": "The path moves from network input through the update service into persistent firmware and then into physical station operation.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "The update pattern is reusable across stations", "detail": "The model assumes deployed stations share the same unsigned update mechanism, allowing the technique to be repeated without a new exploit design.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote installation can extend across a deployment", "detail": "Each exposed station accepts the same network update operation, so repeated uploads do not require opening or physically visiting the devices.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Recovery must restore firmware provenance", "detail": "Assurance returns only after affected stations are verified or reprovisioned behind a signature-enforcing root of trust.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Advisory-backed, not independently reproduced", "detail": "The assessment uses the public NVD advisory and reported vector; this registry has not reproduced the firmware upload.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves deployment uncertainty", "detail": "The record treats the issue as partially mitigated because residual station state and rollout coverage are not independently verified here.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Code installed as trusted firmware can persist beneath application permissions and govern the station's core behavior." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The shared unsigned-update path can be repeated across networked stations, turning a device weakness into deployment-wide operational authority.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:2/DP:2/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "shared-network-update", "kind": "access", "label": "Each station exposes the same unsigned update path", "claim": "The cited update mechanism is reachable over the network without authentication and accepts firmware that lacks a valid signature.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "repeatable-upload", "kind": "boundary", "label": "One protocol can be reused across the PTS", "claim": "If deployed stations share the reported update service, the same straightforward upload can be directed at additional stations without physical access.", "basis": "model-inference", "evidence_refs": [] }, { "id": "distributed-station-control", "kind": "capability", "label": "Firmware governs routing and station behavior", "claim": "Replaced firmware can exercise command authority over station availability, tube routing, and local behavior across the affected deployment.", "basis": "model-inference", "evidence_refs": [] }, { "id": "fleet-authority", "kind": "consequence", "label": "Repetition becomes a fleet control problem", "claim": "Coordinated compromise of multiple stations could disrupt transport operations beyond a single device. This is a modeled deployment consequence, not evidence of exploitation in the field.", "basis": "model-inference", "evidence_refs": [] }, { "id": "fleet-recovery", "kind": "recovery", "label": "Every affected station must return to trusted firmware", "claim": "Recovery is modeled as coordinated verification or reprovisioning across the deployment because leaving one station on the unsigned path preserves the control gap.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network reach does not stop at one station", "detail": "NVD records a network vector with no privileges required, and the fleet model applies that access condition to each exposed station.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "The same low-effort upload can be repeated", "detail": "Missing signature enforcement removes the per-station cryptographic barrier once the update protocol is known.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Fleet attempts retain maximum exposure", "detail": "Repetition does not reduce the underlying network reach or add a new execution hurdle, so exposure stays bounded by two equally permissive inputs.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Multi-station disruption can affect care logistics", "detail": "Coordinated routing or availability failures could delay blood, medicine, or specimen movement; no severe individual harm is claimed as observed.", "basis": "operational-assumption", "evidence_refs": [] }, "DP": { "label": "Operational logistics state is in scope", "detail": "Fleet firmware can expose or alter routing and station state, while this path does not rely on highly sensitive perception data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Deployment command authority is reachable", "detail": "Repeated firmware replacement can govern service behavior across the PTS, a broader operational authority than control of one application process.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Device compromise bridges into deployment operations", "detail": "The shared update mechanism links network access, persistent firmware control, and coordinated transport behavior across system boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared station design enables reuse", "detail": "The fleet conclusion assumes the same update protocol and missing signature check are present across deployed stations.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Execution can be coordinated remotely", "detail": "Multiple stations can be targeted over the network without visiting each device, making deployment-scale execution plausible under the stated assumption.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Remediation is deployment-wide", "detail": "Recovery must identify, verify, and reprovision every exposed station; incomplete coverage leaves an unsigned firmware entry point behind.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report supports the weakness, not fleet execution", "detail": "NVD supports the network unsigned-update condition; this registry has not reproduced coordinated compromise across a deployment.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation does not prove fleet closure", "detail": "The model records partial mitigation while rollout coverage and residual exposed stations remain unverified in this assessment.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same unsigned update path can be repeated across networked stations and recovery requires coordinated deployment-wide verification or reprovisioning." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37160", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "A network update that does not verify signatures can replace the station's trusted firmware and persist beneath application-level controls.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:4/EC:4/EX:4/PH:3/DP:3/AT:4/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "network-update", "kind": "access", "label": "Network update accepts unsigned firmware", "claim": "The cited station update path is network-reachable without authentication and does not require a valid firmware signature.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "upload-barrier", "kind": "boundary", "label": "Protocol knowledge is the main upload barrier", "claim": "Once an attacker can speak the update protocol, no cryptographic signature check remains to reject the uploaded image, making the network operation straightforward.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "firmware-execution", "kind": "capability", "label": "Uploaded code becomes station firmware", "claim": "An accepted image executes below ordinary application controls and replaces the code the station treats as trusted firmware.", "basis": "model-inference", "evidence_refs": [] }, { "id": "trust-root-loss", "kind": "consequence", "label": "Firmware trust is no longer defensible", "claim": "The station can no longer distinguish vendor-authorized firmware from attacker code, giving the replacement image persistent control over station behavior. No field exploitation or patient harm is asserted.", "basis": "model-inference", "evidence_refs": [] }, { "id": "restore-trust", "kind": "recovery", "label": "Trust must be re-established across the deployment", "claim": "Recovery is modeled as verifying or reprovisioning affected stations with a signature-enforcing trust root, not merely restarting the application.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Remote station access", "detail": "NVD classifies the path as network-accessible with no privileges required, so an attacker does not need local contact with a station.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "No signature barrier", "detail": "The update path does not require a valid vendor signature; after the protocol is understood, no cryptographic check blocks the upload.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort are both unrestricted", "detail": "Exposure remains at the shared upper bound because remote reachability and low execution effort support the same conclusion.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Transport disruption can narrow clinical safety margins", "detail": "Stations move blood, medication, and specimens; unsafe routing or stoppage is treated as safety-significant, although this record documents no patient harm.", "basis": "operational-assumption", "evidence_refs": [] }, "DP": { "label": "Firmware and device state are exposed", "detail": "Replacement firmware can observe or alter proprietary station state, but the path does not depend on falsified perception directly driving a safety decision.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware becomes the highest device authority", "detail": "Code installed as trusted firmware can persist beneath application permissions and govern the station's core behavior.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One upload crosses multiple control layers", "detail": "The path moves from network input through the update service into persistent firmware and then into physical station operation.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "The update pattern is reusable across stations", "detail": "The model assumes deployed stations share the same unsigned update mechanism, allowing the technique to be repeated without a new exploit design.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote installation can extend across a deployment", "detail": "Each exposed station accepts the same network update operation, so repeated uploads do not require opening or physically visiting the devices.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Recovery must restore firmware provenance", "detail": "Assurance returns only after affected stations are verified or reprovisioned behind a signature-enforcing root of trust.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Advisory-backed, not independently reproduced", "detail": "The assessment uses the public NVD advisory and reported vector; this registry has not reproduced the firmware upload.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves deployment uncertainty", "detail": "The record treats the issue as partially mitigated because residual station state and rollout coverage are not independently verified here.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Code installed as trusted firmware can persist beneath application permissions and govern the station's core behavior." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The shared unsigned-update path can be repeated across networked stations, turning a device weakness into deployment-wide operational authority.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:2/DP:2/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "shared-network-update", "kind": "access", "label": "Each station exposes the same unsigned update path", "claim": "The cited update mechanism is reachable over the network without authentication and accepts firmware that lacks a valid signature.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "repeatable-upload", "kind": "boundary", "label": "One protocol can be reused across the PTS", "claim": "If deployed stations share the reported update service, the same straightforward upload can be directed at additional stations without physical access.", "basis": "model-inference", "evidence_refs": [] }, { "id": "distributed-station-control", "kind": "capability", "label": "Firmware governs routing and station behavior", "claim": "Replaced firmware can exercise command authority over station availability, tube routing, and local behavior across the affected deployment.", "basis": "model-inference", "evidence_refs": [] }, { "id": "fleet-authority", "kind": "consequence", "label": "Repetition becomes a fleet control problem", "claim": "Coordinated compromise of multiple stations could disrupt transport operations beyond a single device. This is a modeled deployment consequence, not evidence of exploitation in the field.", "basis": "model-inference", "evidence_refs": [] }, { "id": "fleet-recovery", "kind": "recovery", "label": "Every affected station must return to trusted firmware", "claim": "Recovery is modeled as coordinated verification or reprovisioning across the deployment because leaving one station on the unsigned path preserves the control gap.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network reach does not stop at one station", "detail": "NVD records a network vector with no privileges required, and the fleet model applies that access condition to each exposed station.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "The same low-effort upload can be repeated", "detail": "Missing signature enforcement removes the per-station cryptographic barrier once the update protocol is known.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Fleet attempts retain maximum exposure", "detail": "Repetition does not reduce the underlying network reach or add a new execution hurdle, so exposure stays bounded by two equally permissive inputs.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Multi-station disruption can affect care logistics", "detail": "Coordinated routing or availability failures could delay blood, medicine, or specimen movement; no severe individual harm is claimed as observed.", "basis": "operational-assumption", "evidence_refs": [] }, "DP": { "label": "Operational logistics state is in scope", "detail": "Fleet firmware can expose or alter routing and station state, while this path does not rely on highly sensitive perception data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Deployment command authority is reachable", "detail": "Repeated firmware replacement can govern service behavior across the PTS, a broader operational authority than control of one application process.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Device compromise bridges into deployment operations", "detail": "The shared update mechanism links network access, persistent firmware control, and coordinated transport behavior across system boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared station design enables reuse", "detail": "The fleet conclusion assumes the same update protocol and missing signature check are present across deployed stations.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Execution can be coordinated remotely", "detail": "Multiple stations can be targeted over the network without visiting each device, making deployment-scale execution plausible under the stated assumption.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Remediation is deployment-wide", "detail": "Recovery must identify, verify, and reprovision every exposed station; incomplete coverage leaves an unsigned firmware entry point behind.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report supports the weakness, not fleet execution", "detail": "NVD supports the network unsigned-update condition; this registry has not reproduced coordinated compromise across a deployment.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation does not prove fleet closure", "detail": "The model records partial mitigation while rollout coverage and residual exposed stations remain unverified in this assessment.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same unsigned update path can be repeated across networked stations and recovery requires coordinated deployment-wide verification or reprovisioning." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0009" }, { "schema_version": "1.1", "id": "CPATH-2026-0010", "slug": "swisslog-translogic-tlp20-tcptxthread-stack-overflow", "title": "Swisslog Translogic TLP20 tcpTxThread stack overflow", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2021-37164" ], "vendor": "Swisslog", "product": "Swisslog Translogic TLP20 tcpTxThread stack overflow", "domain": "GENERAL_IOT", "cvss": [ { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.8, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "SIDEWAYS", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "device-availability" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:3/EX:3/PH:2/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Unauthenticated network packets to the TLP20 port.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Chains across network to device to control-plane and is noted to chain to firmware persistence, crossing boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patching the vulnerable service and verifying affected stations before returning them to operation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Unauthenticated network packets to the TLP20 port.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Stack overflow with return-address control on a flat-memory RTOS with weak mitigations is a standard-to-advanced researcher workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Remote code execution exposes operational and firmware-relevant state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Code execution in the station controller can govern routing and pneumatic-tube behavior, but it does not provide a vendor firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Chains across network to device to control-plane and is noted to chain to firmware persistence, crossing boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same malformed message can be reused against affected stations that run the vulnerable Translogic service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Network-reachable, no per-device physical access needed.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patching the vulnerable service and verifying affected stations before returning them to operation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:4/EX:4/PH:2/DP:1/AT:2/CH:2/SR:4/SX:4/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The malformed network message can reach any affected station whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Chains less than full remote code execution, but still crosses network to device boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovery requires patching or restarting affected stations and confirming that transport service has been restored.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The malformed network message can reach any affected station whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A single malformed packet can crash the controller; the attacker does not need to turn the overflow into reliable code execution.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "Data and perception minimal (operational).", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Availability loss bounds the consequence to the device and component.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Chains less than full remote code execution, but still crosses network to device boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same vulnerable parser is present across affected station controllers, so the crash method can be repeated.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remotely reachable across stations.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovery requires patching or restarting affected stations and confirming that transport service has been restored.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Loss of the station controller disrupts hospital logistics availability with no severe harm." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37164", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:3/EX:3/PH:2/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Unauthenticated network packets to the TLP20 port.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Chains across network to device to control-plane and is noted to chain to firmware persistence, crossing boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patching the vulnerable service and verifying affected stations before returning them to operation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Unauthenticated network packets to the TLP20 port.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Stack overflow with return-address control on a flat-memory RTOS with weak mitigations is a standard-to-advanced researcher workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Remote code execution exposes operational and firmware-relevant state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Code execution in the station controller can govern routing and pneumatic-tube behavior, but it does not provide a vendor firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Chains across network to device to control-plane and is noted to chain to firmware persistence, crossing boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same malformed message can be reused against affected stations that run the vulnerable Translogic service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Network-reachable, no per-device physical access needed.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patching the vulnerable service and verifying affected stations before returning them to operation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Takeover can mis-route or halt transport, but no credible direct injury or dangerous high-energy actuation is demonstrated." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:4/EX:4/PH:2/DP:1/AT:2/CH:2/SR:4/SX:4/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The malformed network message can reach any affected station whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Chains less than full remote code execution, but still crosses network to device boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovery requires patching or restarting affected stations and confirming that transport service has been restored.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The malformed network message can reach any affected station whose vulnerable service is exposed to the attacker.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A single malformed packet can crash the controller; the attacker does not need to turn the overflow into reliable code execution.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Loss of the station controller disrupts hospital logistics availability with no severe harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "Data and perception minimal (operational).", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Availability loss bounds the consequence to the device and component.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Chains less than full remote code execution, but still crosses network to device boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same vulnerable parser is present across affected station controllers, so the crash method can be repeated.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remotely reachable across stations.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovery requires patching or restarting affected stations and confirming that transport service has been restored.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Loss of the station controller disrupts hospital logistics availability with no severe harm." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0010" }, { "schema_version": "1.1", "id": "CPATH-2026-0011", "slug": "sidequest-deep-link-one-click-rce-on", "title": "SideQuest deep-link one-click RCE on Oculus Quest sideloading platform (CVE-2024-21625)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-21625" ], "vendor": "Meta", "product": "SideQuest deep-link one-click RCE on Oculus Quest sideloading platform (CVE-2024-21625)", "domain": "SMART_GLASSES_AR", "cvss": [ { "version": "v3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "source": "GitHub Advisory via NVD / NVD" } ], "cvss_headline": { "version": "v3.1", "score": 8.8, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1, 2 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "perception-to-action", "account-authority" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:4/EC:3/EX:3/PH:2/DP:4/AT:3/CH:4/SR:4/SX:3/OR:2/EV:1/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The deep link can be delivered through attacker-controlled web content to a user who has SideQuest installed.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Web to desktop to device to perception boundary chain and reusable cross-domain bridge (true).", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovered by app patch plus removing the pushed app, no signing-root rotation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The deep link can be delivered through attacker-controlled web content to a user who has SideQuest installed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Post-remote code execution pivot uses SideQuest's brokered ADB to push arbitrary APKs to the connected headset - standard researcher workflow once code-exec is held, with the extra step requiring a connected device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Changing the immersive environment can disorient the wearer, but the record does not establish a credible injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Installed headset software can control the rendered experience and device services without reaching the firmware or signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Web to desktop to device to perception boundary chain and reusable cross-domain bridge (true).", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Single mass-distributable payload pushing the same APK is reuse across many setups, gated by per-victim connected-headset click.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The same malicious deep link can be distributed broadly, but every target must open it while a headset is connected to the affected SideQuest session.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovered by app patch plus removing the pushed app, no signing-root rotation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Analyst inference", "detail": "The SideQuest deep-link one-click RCE on Oculus Quest sideloading platform (CVE-2024-21625) consequence rests on limited public evidence and remains explicitly provisional.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:2/CH:4/SR:4/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Internet-reachable malicious SideQuest deep link link.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The deep link crosses from web content into the desktop application and can bridge through ADB to headset software.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Updating SideQuest removes the vulnerable handler; no fleet-wide key rotation or device reprovisioning is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Internet-reachable malicious SideQuest deep link link.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single crafted link, one click, commodity Electron deep-link abuse.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Arbitrary software installed on an immersive headset can alter the wearer's rendered environment and create serious disorientation risk; this record does not claim an observed injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Code running as the PC user can read that user’s files and SideQuest credentials or tokens.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The deep link crosses from web content into the desktop application and can bridge through ADB to headset software.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same deep-link payload can be distributed through posts or messages to many SideQuest users, but every compromise still depends on a target opening it.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One deep-link payload can be reused across many SideQuest users, while each target still has to open it with a connected headset.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Updating SideQuest removes the vulnerable handler; no fleet-wide key rotation or device reprovisioning is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21625", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:4/EC:3/EX:3/PH:2/DP:4/AT:3/CH:4/SR:4/SX:3/OR:2/EV:1/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The deep link can be delivered through attacker-controlled web content to a user who has SideQuest installed.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Web to desktop to device to perception boundary chain and reusable cross-domain bridge (true).", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovered by app patch plus removing the pushed app, no signing-root rotation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The deep link can be delivered through attacker-controlled web content to a user who has SideQuest installed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Post-remote code execution pivot uses SideQuest's brokered ADB to push arbitrary APKs to the connected headset - standard researcher workflow once code-exec is held, with the extra step requiring a connected device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Changing the immersive environment can disorient the wearer, but the record does not establish a credible injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Installed headset software can control the rendered experience and device services without reaching the firmware or signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Web to desktop to device to perception boundary chain and reusable cross-domain bridge (true).", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Single mass-distributable payload pushing the same APK is reuse across many setups, gated by per-victim connected-headset click.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The same malicious deep link can be distributed broadly, but every target must open it while a headset is connected to the affected SideQuest session.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovered by app patch plus removing the pushed app, no signing-root rotation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Analyst inference", "detail": "The SideQuest deep-link one-click RCE on Oculus Quest sideloading platform (CVE-2024-21625) consequence rests on limited public evidence and remains explicitly provisional.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A malicious SideQuest deep link can place attacker code in the headset workflow, enabling software that changes the virtual environment the wearer trusts." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:2/CH:4/SR:4/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Internet-reachable malicious SideQuest deep link link.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The deep link crosses from web content into the desktop application and can bridge through ADB to headset software.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Updating SideQuest removes the vulnerable handler; no fleet-wide key rotation or device reprovisioning is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Internet-reachable malicious SideQuest deep link link.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single crafted link, one click, commodity Electron deep-link abuse.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Arbitrary software installed on an immersive headset can alter the wearer's rendered environment and create serious disorientation risk; this record does not claim an observed injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Code running as the PC user can read that user’s files and SideQuest credentials or tokens.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The deep link crosses from web content into the desktop application and can bridge through ADB to headset software.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same deep-link payload can be distributed through posts or messages to many SideQuest users, but every compromise still depends on a target opening it.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One deep-link payload can be reused across many SideQuest users, while each target still has to open it with a connected headset.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Updating SideQuest removes the vulnerable handler; no fleet-wide key rotation or device reprovisioning is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. code execution inherits the logged-in PC user’s privileges inside SideQuest, giving bounded host authority rather than administrator, root, or signing authority." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0011" }, { "schema_version": "1.1", "id": "CPATH-2026-0012", "slug": "inception-attack-malicious-vr-app-hijacks-the", "title": "Inception Attack: malicious VR app hijacks the entire Meta Quest environment (UChicago, 2024)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [], "vendor": "Meta", "product": "Inception Attack: malicious VR app hijacks the entire Meta Quest environment (UChicago, 2024)", "domain": "SMART_GLASSES_AR", "cvss": [], "unscorable_by_cvss": true, "cvss_facts_confidence": "low", "path_verdict": "CRITICAL", "direction": "UNSCORABLE", "requirements_missed": [ 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path; citation coverage remains incomplete and independent path review is open." }, "dominant_path_ids": [ "perception-to-action", "perception-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:3/DP:4/AT:2/CH:4/SR:3/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must share the victim's Wi-Fi network, and the headset must have developer mode enabled; the path is not exposed to the open internet by default.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Bridges network to app overlay to device perception to user physical and decision domain.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "High stealth, hard to observe once established, recoverable by configuration (disable dev mode and untrusted networks) without fleet reprovision.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must share the victim's Wi-Fi network, and the headset must have developer mode enabled; the path is not exposed to the open internet by default.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "The demonstrated setup combines local-network access, application sideloading, and a convincing full-screen overlay in a specialist but repeatable workflow.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Control of the rendered visual field can disorient the wearer and provoke unsafe movement, although the study did not demonstrate a severe injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The malicious overlay mediates the rendered session and user input above the operating system, providing bounded session authority without kernel, signing, or firmware-root control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Bridges network to app overlay to device perception to user physical and decision domain.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The malicious-app technique can be reused across compatible headsets, but each target must install or run the app.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The overlay can be deployed across headsets that share the required network and developer-mode setup, but it is not a zero-touch remote fleet action.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "High stealth, hard to observe once established, recoverable by configuration (disable dev mode and untrusted networks) without fleet reprovision.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions." } }, { "id": "perception-privacy", "role": "co-dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:2/EC:2/EX:2/PH:1/DP:4/AT:2/CH:4/SR:3/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must persuade the user to install or launch the malicious VR application on the target headset.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Captured perception and credentials are a reusable cross-domain bridge (credentials usable elsewhere).", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Stealthy and hard to detect, recoverable by configuration rather than fleet action.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must persuade the user to install or launch the malicious VR application on the target headset.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "The privacy path uses the same demonstrated multi-step setup as the manipulation path: local-network access, developer mode, sideloading, and a convincing overlay application.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Minor physical effect", "detail": "Nuisance-level for the pure-capture consequence (no direct safety effect from observation alone).", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded intermediary control position above the operating system, not a trust-root or administrator and firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Captured perception and credentials are a reusable cross-domain bridge (credentials usable elsewhere).", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The same application technique can be reused across compatible headsets without a device-specific secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Each headset requires its own app installation or launch; there is no fleet execution mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Stealthy and hard to detect, recoverable by configuration rather than fleet action.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session." } } ], "sources": [ { "id": "source-citation-pending-public-url", "label": "source citation pending public URL", "publisher": "source citation pending public URL", "kind": "other" } ], "dominant_paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:3/DP:4/AT:2/CH:4/SR:3/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must share the victim's Wi-Fi network, and the headset must have developer mode enabled; the path is not exposed to the open internet by default.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Bridges network to app overlay to device perception to user physical and decision domain.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "High stealth, hard to observe once established, recoverable by configuration (disable dev mode and untrusted networks) without fleet reprovision.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must share the victim's Wi-Fi network, and the headset must have developer mode enabled; the path is not exposed to the open internet by default.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "The demonstrated setup combines local-network access, application sideloading, and a convincing full-screen overlay in a specialist but repeatable workflow.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Control of the rendered visual field can disorient the wearer and provoke unsafe movement, although the study did not demonstrate a severe injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The malicious overlay mediates the rendered session and user input above the operating system, providing bounded session authority without kernel, signing, or firmware-root control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Bridges network to app overlay to device perception to user physical and decision domain.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The malicious-app technique can be reused across compatible headsets, but each target must install or run the app.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The overlay can be deployed across headsets that share the required network and developer-mode setup, but it is not a zero-touch remote fleet action.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "High stealth, hard to observe once established, recoverable by configuration (disable dev mode and untrusted networks) without fleet reprovision.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A malicious VR app can replace the rendered environment and interaction state that the wearer trusts, allowing manipulated perception to steer safety-relevant actions." } }, { "id": "perception-privacy", "role": "co-dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:2/EC:2/EX:2/PH:1/DP:4/AT:2/CH:4/SR:3/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must persuade the user to install or launch the malicious VR application on the target headset.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Captured perception and credentials are a reusable cross-domain bridge (credentials usable elsewhere).", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Stealthy and hard to detect, recoverable by configuration rather than fleet action.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must persuade the user to install or launch the malicious VR application on the target headset.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "The privacy path uses the same demonstrated multi-step setup as the manipulation path: local-network access, developer mode, sideloading, and a convincing overlay application.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Minor physical effect", "detail": "Nuisance-level for the pure-capture consequence (no direct safety effect from observation alone).", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded intermediary control position above the operating system, not a trust-root or administrator and firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Captured perception and credentials are a reusable cross-domain bridge (credentials usable elsewhere).", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The same application technique can be reused across compatible headsets without a device-specific secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Each headset requires its own app installation or launch; there is no fleet execution mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Stealthy and hard to detect, recoverable by configuration rather than fleet action.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The malicious environment can capture live motion, gaze-related, biometric, and credential information from the headset session." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0012" }, { "schema_version": "1.1", "id": "CPATH-2026-0013", "slug": "gazeploit-remote-keystroke-inference-from-vision-pro", "title": "GAZEploit: keystroke inference from Vision Pro Persona eye movements (CVE-2024-40865)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-40865" ], "vendor": "Apple", "product": "Apple Vision Pro (visionOS · Persona avatar)", "domain": "SMART_GLASSES_AR", "cvss": [ { "version": "v3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "source": "NVD / CNA via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 5.3, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 9, 3 ], "review": { "state": "provisional", "summary": "Paper-backed Persona observation and keystroke inference; account authority remains explicitly conditional on recovery and reuse of a valid credential." }, "dominant_path_ids": [ "perception-privacy", "account-authority" ], "dominance_reason": "The privacy and account paths are co-dominant at CRITICAL because one outward Persona channel can disclose typed content and, conditionally, credentials that cross into account authority; neither is selected by array order.", "paths": [ { "id": "perception-privacy", "role": "co-dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Sanctioned Persona output carries gaze-correlated motion that can be reconstructed into typed content outside the headset.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:4/EC:3/EX:3/PH:0/DP:4/AT:0/CH:2/SR:3/SX:4/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "persona-output", "kind": "access", "label": "Sanctioned Persona output", "claim": "The GAZEploit paper and project demonstrate that ordinary, sanctioned Persona output in video calls exposes avatar eye movements to a remote observer without direct access to headset sensor data.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "gaze-representation-boundary", "kind": "boundary", "label": "Gaze representation crosses the headset boundary", "claim": "Persona faithfully represents gaze-correlated eye movement across the headset boundary; the model treats that outward avatar signal as perception-derived data rather than direct sensor export.", "basis": "model-inference", "evidence_refs": [] }, { "id": "keystroke-reconstruction", "kind": "transition", "label": "Keystroke reconstruction", "claim": "The researchers report reconstructing a virtual keyboard layout and inferring keystrokes from the observed Persona gaze sequence.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "typed-content-disclosure", "kind": "consequence", "label": "Typed content disclosure", "claim": "Inferred keystrokes can disclose private typed content to the remote observer. This path records demonstrated inference capability, not confirmed exploitation in the field.", "basis": "model-inference", "evidence_refs": [] }, { "id": "patch-status", "kind": "recovery", "label": "Patched in visionOS 1.3", "claim": "The NVD record identifies a fix in visionOS 1.3; the registry therefore records PATCH_AVAILABLE rather than claiming the condition remains active on updated systems.", "basis": "source", "evidence_refs": [ "nvd" ] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "An ordinary remote participant can receive the sanctioned Persona avatar output without compromising the Vision Pro headset.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Recovering typed content requires gaze analysis and reconstruction, but the researchers demonstrated a reproducible workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The Apple Vision Pro (visionOS · Persona avatar) interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The Persona leakage does not directly actuate the headset or create a physical safety effect.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Eye movement represented in the avatar can reveal keystrokes and other intimate interaction signals that the user did not intend to transmit.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "No authority gained", "detail": "Observing gaze-derived output provides no direct account, administrative, or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Sanctioned avatar output crosses the gaze-privacy boundary and can be transformed into reconstructed keyboard input.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The reconstruction technique is reusable across compatible Persona sessions, though it is not a shared credential or universal key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "A remote participant can collect the permitted avatar stream without per-device physical access to the target headset.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "VisionOS 1.3 changed the exposed representation; recovery is a software update and verification that affected headsets upgraded.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions. This status is recorded for Apple Vision Pro (visionOS · Persona avatar).", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Eye movement represented in the avatar can reveal keystrokes and other intimate interaction signals that the user did not intend to transmit." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "Reconstructed keystrokes may include passwords or credentials whose successful reuse crosses into account authority.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:3/EX:3/PH:0/DP:3/AT:3/CH:3/SR:3/SX:4/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "remote-observation", "kind": "access", "label": "Remote Persona observation", "claim": "A remote participant can receive the ordinary Persona stream and observe the gaze-correlated avatar motion documented by GAZEploit.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "credential-reconstruction", "kind": "transition", "label": "Credential reconstruction", "claim": "Passwords or other credentials can be recovered from inferred keystrokes; using a valid recovered secret is the additional transition into account authority.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "credential-use-boundary", "kind": "boundary", "label": "Credential use is a separate boundary", "claim": "The paper demonstrates keystroke inference, not successful account takeover. Account authority therefore depends on the inferred text containing a usable credential and on that credential remaining valid.", "basis": "model-inference", "evidence_refs": [] }, { "id": "account-consequence", "kind": "consequence", "label": "Account authority", "claim": "If those conditions hold, credential reuse can enable unauthorized account access. CRITICAL is a modeled candidate consequence, not evidence that GAZEploit produced an observed takeover.", "basis": "model-inference", "evidence_refs": [] }, { "id": "patch-and-credential-recovery", "kind": "recovery", "label": "Patch and rotate exposed secrets", "claim": "With the visionOS 1.3 fix available, recovery is modeled as updating affected systems and separately rotating credentials if prior observation is suspected.", "basis": "operational-assumption", "evidence_refs": [ "nvd" ] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "A remote participant receives Persona output through the intended communication channel, so no headset exploit is needed to observe it.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Turning gaze traces into typed strings requires the demonstrated reconstruction pipeline rather than a direct plaintext read.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The Apple Vision Pro (visionOS · Persona avatar) interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Credential reconstruction does not itself control physical actuation or create a direct safety consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The reconstructed strings can include passwords and other authentication secrets typed while Persona output is shared.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "A recovered password can transfer authority to the associated account, but the avatar stream grants no headset administrator rights by itself.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Legitimate avatar output becomes a gaze trace, then a typed credential, and finally a potential account-access bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The analysis method can be reused across sessions and users, while each recovered credential remains target-specific.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remote collection can occur through normal Persona sessions without physical access to each headset.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "VisionOS 1.3 patched the representation leak; exposed credentials may still require separate rotation and account review.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions. This status is recorded for Apple Vision Pro (visionOS · Persona avatar).", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A recovered password can transfer authority to the associated account, but the avatar stream grants no headset administrator rights by itself." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40865", "publisher": "NVD", "kind": "advisory" }, { "id": "gazeploit-paper-arxiv-2409-08122", "label": "GAZEploit paper (arXiv:2409.08122)", "url": "https://arxiv.org/abs/2409.08122", "publisher": "GAZEploit paper", "kind": "paper" }, { "id": "project-site", "label": "Project site", "url": "https://sites.google.com/view/gazeploit/", "publisher": "Project site", "kind": "poc" } ], "dominant_paths": [ { "id": "perception-privacy", "role": "co-dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Sanctioned Persona output carries gaze-correlated motion that can be reconstructed into typed content outside the headset.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:4/EC:3/EX:3/PH:0/DP:4/AT:0/CH:2/SR:3/SX:4/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "persona-output", "kind": "access", "label": "Sanctioned Persona output", "claim": "The GAZEploit paper and project demonstrate that ordinary, sanctioned Persona output in video calls exposes avatar eye movements to a remote observer without direct access to headset sensor data.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "gaze-representation-boundary", "kind": "boundary", "label": "Gaze representation crosses the headset boundary", "claim": "Persona faithfully represents gaze-correlated eye movement across the headset boundary; the model treats that outward avatar signal as perception-derived data rather than direct sensor export.", "basis": "model-inference", "evidence_refs": [] }, { "id": "keystroke-reconstruction", "kind": "transition", "label": "Keystroke reconstruction", "claim": "The researchers report reconstructing a virtual keyboard layout and inferring keystrokes from the observed Persona gaze sequence.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "typed-content-disclosure", "kind": "consequence", "label": "Typed content disclosure", "claim": "Inferred keystrokes can disclose private typed content to the remote observer. This path records demonstrated inference capability, not confirmed exploitation in the field.", "basis": "model-inference", "evidence_refs": [] }, { "id": "patch-status", "kind": "recovery", "label": "Patched in visionOS 1.3", "claim": "The NVD record identifies a fix in visionOS 1.3; the registry therefore records PATCH_AVAILABLE rather than claiming the condition remains active on updated systems.", "basis": "source", "evidence_refs": [ "nvd" ] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "An ordinary remote participant can receive the sanctioned Persona avatar output without compromising the Vision Pro headset.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Recovering typed content requires gaze analysis and reconstruction, but the researchers demonstrated a reproducible workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The Apple Vision Pro (visionOS · Persona avatar) interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The Persona leakage does not directly actuate the headset or create a physical safety effect.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Eye movement represented in the avatar can reveal keystrokes and other intimate interaction signals that the user did not intend to transmit.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "No authority gained", "detail": "Observing gaze-derived output provides no direct account, administrative, or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Sanctioned avatar output crosses the gaze-privacy boundary and can be transformed into reconstructed keyboard input.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The reconstruction technique is reusable across compatible Persona sessions, though it is not a shared credential or universal key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "A remote participant can collect the permitted avatar stream without per-device physical access to the target headset.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "VisionOS 1.3 changed the exposed representation; recovery is a software update and verification that affected headsets upgraded.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions. This status is recorded for Apple Vision Pro (visionOS · Persona avatar).", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Eye movement represented in the avatar can reveal keystrokes and other intimate interaction signals that the user did not intend to transmit." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "Reconstructed keystrokes may include passwords or credentials whose successful reuse crosses into account authority.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:3/EX:3/PH:0/DP:3/AT:3/CH:3/SR:3/SX:4/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "remote-observation", "kind": "access", "label": "Remote Persona observation", "claim": "A remote participant can receive the ordinary Persona stream and observe the gaze-correlated avatar motion documented by GAZEploit.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "credential-reconstruction", "kind": "transition", "label": "Credential reconstruction", "claim": "Passwords or other credentials can be recovered from inferred keystrokes; using a valid recovered secret is the additional transition into account authority.", "basis": "source", "evidence_refs": [ "gazeploit-paper-arxiv-2409-08122", "project-site" ] }, { "id": "credential-use-boundary", "kind": "boundary", "label": "Credential use is a separate boundary", "claim": "The paper demonstrates keystroke inference, not successful account takeover. Account authority therefore depends on the inferred text containing a usable credential and on that credential remaining valid.", "basis": "model-inference", "evidence_refs": [] }, { "id": "account-consequence", "kind": "consequence", "label": "Account authority", "claim": "If those conditions hold, credential reuse can enable unauthorized account access. CRITICAL is a modeled candidate consequence, not evidence that GAZEploit produced an observed takeover.", "basis": "model-inference", "evidence_refs": [] }, { "id": "patch-and-credential-recovery", "kind": "recovery", "label": "Patch and rotate exposed secrets", "claim": "With the visionOS 1.3 fix available, recovery is modeled as updating affected systems and separately rotating credentials if prior observation is suspected.", "basis": "operational-assumption", "evidence_refs": [ "nvd" ] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "A remote participant receives Persona output through the intended communication channel, so no headset exploit is needed to observe it.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Turning gaze traces into typed strings requires the demonstrated reconstruction pipeline rather than a direct plaintext read.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The Apple Vision Pro (visionOS · Persona avatar) interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Credential reconstruction does not itself control physical actuation or create a direct safety consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The reconstructed strings can include passwords and other authentication secrets typed while Persona output is shared.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "A recovered password can transfer authority to the associated account, but the avatar stream grants no headset administrator rights by itself.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Legitimate avatar output becomes a gaze trace, then a typed credential, and finally a potential account-access bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The analysis method can be reused across sessions and users, while each recovered credential remains target-specific.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remote collection can occur through normal Persona sessions without physical access to each headset.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "VisionOS 1.3 patched the representation leak; exposed credentials may still require separate rotation and account review.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions. This status is recorded for Apple Vision Pro (visionOS · Persona avatar).", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A recovered password can transfer authority to the associated account, but the avatar stream grants no headset administrator rights by itself." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0013" }, { "schema_version": "1.1", "id": "CPATH-2026-0014", "slug": "hololens-broadcom-wi-fi-over-the-air", "title": "HoloLens Broadcom Wi-Fi over-the-air RCE/DoS (ADV190017: CVE-2019-9501/9503)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2019-9500", "CVE-2019-9501", "CVE-2019-9502", "CVE-2019-9503" ], "vendor": "Microsoft", "product": "HoloLens Broadcom Wi-Fi over-the-air RCE/DoS (ADV190017: CVE-2019-9501/9503)", "domain": "SMART_GLASSES_AR", "cvss": [ { "version": "v3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "source": "NVD (CVE-2019-9500)" }, { "version": "v3.1", "score": 7.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "source": "CERT/CC via NVD (CVE-2019-9500)" }, { "version": "v3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD (CVE-2019-9501)" }, { "version": "v3.1", "score": 7.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "source": "CERT/CC via NVD (CVE-2019-9501)" }, { "version": "v3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD (CVE-2019-9502)" }, { "version": "v3.1", "score": 7.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "source": "CERT/CC via NVD (CVE-2019-9502)" }, { "version": "v3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "source": "NVD (CVE-2019-9503)" }, { "version": "v3.1", "score": 7.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "source": "CERT/CC via NVD (CVE-2019-9503)" } ], "cvss_headline": { "version": "v3.1", "score": 8.8, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1, 2 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "device-control-safety", "role": "dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:1/EX:1/PH:3/DP:4/AT:3/CH:4/SR:4/SX:2/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Wi-Fi radio proximity, unauthenticated, no association or victim physical access (adjacent radio range).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Driver and kernel compromise crosses radio to device to perception and safety boundaries and is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires installing the vendor update on each affected headset and validating normal wireless operation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Wi-Fi radio proximity, unauthenticated, no association or victim physical access (adjacent radio range).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Narrow or timing-dependent technique", "detail": "Reliable heap-overflow remote code execution is exploit-dependent, fragile and timing-sensitive (denial of service is easy, code execution is hard).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Code execution exposes camera and spatial-map and live-sensor world-model state and can affect rendered-environment integrity.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Native code execution in the wireless driver reaches kernel or service-level device authority, but not the signing or firmware-update root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Driver and kernel compromise crosses radio to device to perception and safety boundaries and is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The over-the-air exploit can be reused against HoloLens devices that contain the affected Broadcom wireless component.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "The code-execution attempt must be made within Wi-Fi range of each target headset rather than through a remote fleet channel.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires installing the vendor update on each affected headset and validating normal wireless operation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use)." } }, { "id": "device-availability", "role": "supporting", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:2/EC:4/EX:2/PH:2/DP:0/AT:2/CH:2/SR:4/SX:2/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Wi-Fi proximity, unauthenticated, no physical access.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Crosses radio to device boundary but is not a reusable cross-domain authority bridge on its own.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Device reboots and recovers.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Wi-Fi proximity, unauthenticated, no physical access.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Crafted Wi-Fi frames can reliably interrupt service with one short exchange; this path does not require the harder code-execution chain.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "The availability path disrupts headset operation without independently exposing sensitive user data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded availability impact of the device and component, no authority gain.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Crosses radio to device boundary but is not a reusable cross-domain authority bridge on its own.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Identical frame payload reusable against any affected Broadcom-driver unit (shared component).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "The attacker must be within Wi-Fi radio range of each HoloLens, so interruption remains one nearby device at a time.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Device reboots and recovers.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9500", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-2", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9501", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-3", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9502", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-4", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9503", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:1/EX:1/PH:3/DP:4/AT:3/CH:4/SR:4/SX:2/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Wi-Fi radio proximity, unauthenticated, no association or victim physical access (adjacent radio range).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Driver and kernel compromise crosses radio to device to perception and safety boundaries and is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires installing the vendor update on each affected headset and validating normal wireless operation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Wi-Fi radio proximity, unauthenticated, no association or victim physical access (adjacent radio range).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Narrow or timing-dependent technique", "detail": "Reliable heap-overflow remote code execution is exploit-dependent, fragile and timing-sensitive (denial of service is easy, code execution is hard).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Code execution exposes camera and spatial-map and live-sensor world-model state and can affect rendered-environment integrity.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Native code execution in the wireless driver reaches kernel or service-level device authority, but not the signing or firmware-update root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Driver and kernel compromise crosses radio to device to perception and safety boundaries and is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The over-the-air exploit can be reused against HoloLens devices that contain the affected Broadcom wireless component.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "The code-execution attempt must be made within Wi-Fi range of each target headset rather than through a remote fleet channel.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires installing the vendor update on each affected headset and validating normal wireless operation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use)." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0014" }, { "schema_version": "1.1", "id": "CPATH-2026-0015", "slug": "hololens-device-portal-pairing-api-unauthenticated-dos", "title": "HoloLens Device Portal pairing-API unauthenticated DoS (CVE-2024-57972)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-57972" ], "vendor": "Microsoft", "product": "HoloLens Device Portal pairing-API unauthenticated DoS (CVE-2024-57972)", "domain": "SMART_GLASSES_AR", "cvss": [ { "version": "v3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "source": "MITRE via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 6.5, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-availability" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "device-availability", "role": "dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:4/EX:4/PH:2/DP:0/AT:0/CH:1/SR:2/SX:3/OR:1/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Network-reachable, without authentication, no user interaction (gated only by whether Device Portal is enabled and reachable, but per rule position is internet and default-exposed-style network reachability).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Single bounded transition", "claim": "Availability loss is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Routine local recovery", "claim": "Stopping the request flood and rebooting the headset restores service; no fleet reprovisioning or key rotation is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Network-reachable, without authentication, no user interaction (gated only by whether Device Portal is enabled and reachable, but per rule position is internet and default-exposed-style network reachability).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A straightforward request flood is sufficient once the Device Portal is reachable; no memory-corruption exploit is needed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "The request flood affects service availability without independently exposing stored or streamed user data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "No authority gained", "detail": "The attacker can exhaust the pairing service but does not gain an authenticated session or broader device authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Single bounded transition", "detail": "Availability loss is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The same request pattern can be reused against HoloLens devices that expose the vulnerable portal service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The attacker must direct traffic at each reachable headset; the weakness does not provide a fleet-wide execution channel.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Routine local recovery", "detail": "Stopping the request flood and rebooting the headset restores service; no fleet reprovisioning or key rotation is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57972", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-availability", "role": "dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:4/EX:4/PH:2/DP:0/AT:0/CH:1/SR:2/SX:3/OR:1/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Network-reachable, without authentication, no user interaction (gated only by whether Device Portal is enabled and reachable, but per rule position is internet and default-exposed-style network reachability).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Single bounded transition", "claim": "Availability loss is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Routine local recovery", "claim": "Stopping the request flood and rebooting the headset restores service; no fleet reprovisioning or key rotation is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Network-reachable, without authentication, no user interaction (gated only by whether Device Portal is enabled and reachable, but per rule position is internet and default-exposed-style network reachability).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A straightforward request flood is sufficient once the Device Portal is reachable; no memory-corruption exploit is needed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "The request flood affects service availability without independently exposing stored or streamed user data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "No authority gained", "detail": "The attacker can exhaust the pairing service but does not gain an authenticated session or broader device authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Single bounded transition", "detail": "Availability loss is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The same request pattern can be reused against HoloLens devices that expose the vulnerable portal service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The attacker must direct traffic at each reachable headset; the weakness does not provide a fleet-wide execution channel.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Routine local recovery", "detail": "Stopping the request flood and rebooting the headset restores service; no fleet reprovisioning or key rotation is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthenticated pairing requests can disrupt the head-worn AR overlay during use, creating a bounded availability and situational-awareness problem rather than persistent control." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0015" }, { "schema_version": "1.1", "id": "CPATH-2026-0016", "slug": "face-mic-zero-permission-motion-sensor-speech", "title": "Face-Mic: zero-permission motion-sensor speech and speaker-identity eavesdropping on AR/VR headsets (Rutgers/NJIT, 2021)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [], "vendor": "Meta", "product": "Face-Mic: zero-permission motion-sensor speech and speaker-identity eavesdropping on AR/VR headsets (Rutgers/NJIT, 2021)", "domain": "SMART_GLASSES_AR", "cvss": [], "unscorable_by_cvss": true, "cvss_facts_confidence": "low", "path_verdict": "CRITICAL", "direction": "UNSCORABLE", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path; citation coverage remains incomplete and independent path review is open." }, "dominant_path_ids": [ "perception-privacy" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "perception-privacy", "role": "dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Leaks live speech content from sensors users never perceive as a microphone.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:3/EC:3/EX:3/PH:0/DP:4/AT:1/CH:2/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "A zero-permission application on the headset can sample the motion sensor without prompting the user.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Enables further inference but not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Leaks live speech content from sensors users never perceive as a microphone.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Leaks live speech content from sensors users never perceive as a microphone.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Largely unpatchable since sensors are core to head tracking, recovery requires hardware and platform-level change; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "A zero-permission application on the headset can sample the motion sensor without prompting the user.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Standard ML researcher workflow (sensor capture and deep-learning pipeline).", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The inferred speech exposes private conversation but does not directly drive a physical or safety decision.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Leaks live speech content from sensors users never perceive as a microphone.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Read-only or preparatory access", "detail": "The exploited surface is the absence of a permission gate, not elevated privilege, exploiting a read-only sensor feature.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Enables further inference but not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The inference technique can be reused across compatible headsets because it does not depend on a device-specific secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Each headset must run the sampling application and process its own sensor stream.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Largely unpatchable since sensors are core to head tracking, recovery requires hardware and platform-level change; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Leaks live speech content from sensors users never perceive as a microphone." } }, { "id": "data-privacy", "role": "supporting", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Motion-sensor inference can reveal speaker identity and other persistent biometric attributes in addition to reconstructing speech content.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:3/EC:3/EX:3/PH:0/DP:3/AT:1/CH:2/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "A zero-permission application on the headset can sample the motion sensor without prompting the user.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Biometric identity could feed deanonymization but is not a reusable authority-transfer bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Motion-sensor inference can reveal speaker identity and other persistent biometric attributes in addition to reconstructing speech content.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Motion-sensor inference can reveal speaker identity and other persistent biometric attributes in addition to reconstructing speech content.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Unpatchable sensor-design property, recovery needs platform and hardware change; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "A zero-permission application on the headset can sample the motion sensor without prompting the user.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Inferring speaker identity from motion-sensor traces requires the demonstrated machine-learning pipeline and trained classifier.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The recovered speech content creates a privacy consequence without directly changing physical behavior.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Motion-sensor inference can reveal speaker identity and other persistent biometric attributes in addition to reconstructing speech content.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Read-only or preparatory access", "detail": "Absence of permission gate on a read-only sensor, no elevated privilege.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Biometric identity could feed deanonymization but is not a reusable authority-transfer bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One reusable model across mainstream headsets exploiting a shared design flaw.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Each headset must run the sampling application and process its own sensor stream.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Unpatchable sensor-design property, recovery needs platform and hardware change; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Motion-sensor inference can reveal speaker identity and other persistent biometric attributes in addition to reconstructing speech content." } } ], "sources": [ { "id": "source-citation-pending-public-url", "label": "source citation pending public URL", "publisher": "source citation pending public URL", "kind": "other" } ], "dominant_paths": [ { "id": "perception-privacy", "role": "dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Leaks live speech content from sensors users never perceive as a microphone.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:3/EC:3/EX:3/PH:0/DP:4/AT:1/CH:2/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "A zero-permission application on the headset can sample the motion sensor without prompting the user.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Enables further inference but not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Leaks live speech content from sensors users never perceive as a microphone.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Leaks live speech content from sensors users never perceive as a microphone.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Largely unpatchable since sensors are core to head tracking, recovery requires hardware and platform-level change; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "A zero-permission application on the headset can sample the motion sensor without prompting the user.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Standard ML researcher workflow (sensor capture and deep-learning pipeline).", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The inferred speech exposes private conversation but does not directly drive a physical or safety decision.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Leaks live speech content from sensors users never perceive as a microphone.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Read-only or preparatory access", "detail": "The exploited surface is the absence of a permission gate, not elevated privilege, exploiting a read-only sensor feature.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Enables further inference but not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The inference technique can be reused across compatible headsets because it does not depend on a device-specific secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Each headset must run the sampling application and process its own sensor stream.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Largely unpatchable since sensors are core to head tracking, recovery requires hardware and platform-level change; fleet-wide recovery is required.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Leaks live speech content from sensors users never perceive as a microphone." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0016" }, { "schema_version": "1.1", "id": "CPATH-2026-0017", "slug": "px4-autopilot-mavlink-unauthenticated-remote-shell-cve", "title": "PX4 Autopilot MAVLink Unauthenticated Remote Shell (CVE-2026-1579)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2026-1579" ], "vendor": "PX4 / Dronecode", "product": "PX4 Autopilot MAVLink Unauthenticated Remote Shell (CVE-2026-1579)", "domain": "DRONE_AV", "cvss": [ { "version": "v4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "CISA/ICS-CERT via NVD" }, { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "CISA/ICS-CERT via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.8, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, EMERGENCY.", "paths": [ { "id": "device-control-safety", "role": "dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:4/DP:4/AT:4/CH:4/SR:4/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Any attacker who can reach the MAVLink network or radio interface can target vehicles where message signing remains disabled.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The path crosses from network or radio traffic into the flight-controller shell and then into physical vehicle actuation.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires enabling MAVLink signing and segmenting control traffic across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Any attacker who can reach the MAVLink network or radio interface can target vehicles where message signing remains disabled.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single crafted SERIAL_CONTROL message, no memory-corruption primitive.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Shell can read and inject into perception and control loops (navigation, sensor state) that drive flight.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "The interactive shell reaches the flight controller’s highest operating authority and can change mission or actuation state.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The path crosses from network or radio traffic into the flight-controller shell and then into physical vehicle actuation.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Missing-auth design default in widely deployed open-source firmware, single reused technique, no per-target artifact.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The same MAVLink command can be repeated against network-reachable PX4 vehicles that have signing disabled, without visiting each airframe.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires enabling MAVLink signing and segmenting control traffic across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Attacker can disarm, alter mission, command flight, or crash the vehicle." } }, { "id": "data-privacy", "role": "supporting", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Remote shell access can expose telemetry, mission plans, and onboard storage containing sensitive operational and proprietary data.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:4/EX:4/PH:0/DP:3/AT:4/CH:3/SR:4/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The data path uses the same unauthenticated MAVLink shell entry as the safety path, requiring only network or radio reachability.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The path crosses from the network into the flight controller and then into stored mission and telemetry data, making the shell a reusable extraction bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Remote shell access can expose telemetry, mission plans, and onboard storage containing sensitive operational and proprietary data.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Remote shell access can expose telemetry, mission plans, and onboard storage containing sensitive operational and proprietary data.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires enabling MAVLink signing and segmenting control traffic across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The data path uses the same unauthenticated MAVLink shell entry as the safety path, requiring only network or radio reachability.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The same single unauthenticated MAVLink message opens the shell; reading telemetry, mission files, or onboard storage requires no second exploit chain.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "This path exfiltrates data without directly changing physical behavior or a safety decision.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Remote shell access can expose telemetry, mission plans, and onboard storage containing sensitive operational and proprietary data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "The shell grants the flight controller’s highest operating authority, although this path uses it to read mission and telemetry data.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The path crosses from the network into the flight controller and then into stored mission and telemetry data, making the shell a reusable extraction bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The missing-authentication design is shared across affected PX4 deployments, so the shell technique is portable across vehicles.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The shell operation can be repeated against any network-reachable PX4 vehicle with signing disabled, without physical access to each one.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires enabling MAVLink signing and segmenting control traffic across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "cap", "reason": "The EMERGENCY base consequence is capped at CRITICAL because this path exposes sensitive mission and telemetry data but does not independently reach a safety-driving perception or physical-control consequence." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1579", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:4/DP:4/AT:4/CH:4/SR:4/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Any attacker who can reach the MAVLink network or radio interface can target vehicles where message signing remains disabled.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The path crosses from network or radio traffic into the flight-controller shell and then into physical vehicle actuation.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires enabling MAVLink signing and segmenting control traffic across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Any attacker who can reach the MAVLink network or radio interface can target vehicles where message signing remains disabled.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single crafted SERIAL_CONTROL message, no memory-corruption primitive.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Attacker can disarm, alter mission, command flight, or crash the vehicle.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Shell can read and inject into perception and control loops (navigation, sensor state) that drive flight.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "The interactive shell reaches the flight controller’s highest operating authority and can change mission or actuation state.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The path crosses from network or radio traffic into the flight-controller shell and then into physical vehicle actuation.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Missing-auth design default in widely deployed open-source firmware, single reused technique, no per-target artifact.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The same MAVLink command can be repeated against network-reachable PX4 vehicles that have signing disabled, without visiting each airframe.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires enabling MAVLink signing and segmenting control traffic across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Attacker can disarm, alter mission, command flight, or crash the vehicle." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0017" }, { "schema_version": "1.1", "id": "CPATH-2026-0018", "slug": "tesla-model-3-vcsec-tpms-integer-overflow", "title": "Tesla Model 3 VCSEC TPMS Integer Overflow RCE (CVE-2025-2082)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2025-2082" ], "vendor": "Tesla", "product": "Tesla Model 3 VCSEC TPMS Integer Overflow RCE (CVE-2025-2082)", "domain": "DRONE_AV", "cvss": [ { "version": "v3.0", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "ZDI via NVD" } ], "cvss_headline": { "version": "v3.0", "score": 7.5, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1, 2, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "perception-to-action" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "perception-to-action", "role": "dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:3/DP:4/AT:3/CH:4/SR:4/SX:2/OR:4/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Adjacent RF range to inject crafted TPMS cert_response.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "RF perception to remote code execution to CAN actuation bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Firmware-update fleet update.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Adjacent RF range to inject crafted TPMS cert_response.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible integer-overflow exploit.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "The corrupted perception and control path leads to actuation (immobilizer and lock state) affecting vehicle security and theft risk, safety-margin reduction.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The module trusting TPMS perception is the security and immobilizer controller.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "RF perception to remote code execution to CAN actuation bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Portable firmware exploit.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "The TPMS exploit must be delivered within radio range of each target vehicle.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Firmware-update fleet update.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions." } }, { "id": "device-control-safety", "role": "supporting", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "CAN-level influence can disable protective functions or unlock the vehicle, reducing safety margins and enabling theft or interference with vehicle controls.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:3/DP:3/AT:3/CH:4/SR:4/SX:2/OR:4/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Adjacent RF and TPMS wireless range, no physical contact, without credentials.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Cross-domain authority transfer: RF sensor input to code execution on security module to CAN bus to vehicle commands, a reusable multi-hop bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "CAN-level influence can disable protective functions or unlock the vehicle, reducing safety margins and enabling theft or interference with vehicle controls.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "CAN-level influence can disable protective functions or unlock the vehicle, reducing safety margins and enabling theft or interference with vehicle controls.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Tesla remediation required a firmware update and coordinated rollout across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Adjacent RF and TPMS wireless range, no physical contact, without credentials.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "The Pwn2Own demonstration used a repeatable but specialist integer-overflow exploit chain against the VCSEC module.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "CAN-level influence can disable protective functions or unlock the vehicle, reducing safety margins and enabling theft or interference with vehicle controls.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The path changes vehicle-security state without independently exposing a broader store of sensitive data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Administrator and service authority over the VCSEC security module (immobilizer, locks) plus CAN-command injection, but not a signing and firmware-update trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Cross-domain authority transfer: RF sensor input to code execution on security module to CAN bus to vehicle commands, a reusable multi-hop bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The crafted TPMS input can be reused against vehicles that contain the same vulnerable VCSEC implementation.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Still per-vehicle proximity attack, no fleet-wide remote trigger.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Tesla remediation required a firmware update and coordinated rollout across affected vehicles.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. CAN-level influence can disable protective functions or unlock the vehicle, reducing safety margins and enabling theft or interference with vehicle controls." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2082", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "perception-to-action", "role": "dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:3/DP:4/AT:3/CH:4/SR:4/SX:2/OR:4/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Adjacent RF range to inject crafted TPMS cert_response.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "RF perception to remote code execution to CAN actuation bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Firmware-update fleet update.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Adjacent RF range to inject crafted TPMS cert_response.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible integer-overflow exploit.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "The corrupted perception and control path leads to actuation (immobilizer and lock state) affecting vehicle security and theft risk, safety-margin reduction.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The module trusting TPMS perception is the security and immobilizer controller.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "RF perception to remote code execution to CAN actuation bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Portable firmware exploit.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "The TPMS exploit must be delivered within radio range of each target vehicle.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Firmware-update fleet update.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Manipulated tire-pressure sensor messages enter the vehicle’s trusted perception channel and can influence the control module’s decisions." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0018" }, { "schema_version": "1.1", "id": "CPATH-2026-0019", "slug": "tesla-model-3-gateway-firmware-signature-bypass", "title": "Tesla Model 3 Gateway Firmware Signature-Bypass / TOCTTOU Code Execution (CVE-2023-32156)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2023-32156" ], "vendor": "Tesla", "product": "Tesla Model 3 Gateway Firmware Signature-Bypass / TOCTTOU Code Execution (CVE-2023-32156)", "domain": "DRONE_AV", "cvss": [ { "version": "v3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD" }, { "version": "v3.0", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "source": "ZDI via NVD" } ], "cvss_headline": { "version": "v3.0", "score": 9, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "SIDEWAYS", "requirements_missed": [ 1, 2 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "firmware-trust-root" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:1/EC:3/EX:1/PH:4/DP:3/AT:3/CH:4/SR:3/SX:3/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "Position requires prior privileged foothold on infotainment then lateral move to the Gateway ECU (internal, not open-net).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Cross-domain bridge: app and infotainment to internal bus to physical actuation crosses multiple boundaries and is a reusable pivot.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recoverable through a firmware update.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "Position requires prior privileged foothold on infotainment then lateral move to the Gateway ECU (internal, not open-net).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The Gateway step itself is low-complexity but reaching it needs the chained foothold is standard-to-advanced researcher workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Gateway compromise exposes vehicle configuration, command, and operational state rather than relying on personal data or a separate perception feed.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The path reaches administrative control over vehicle command functions, but not the gateway signing or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Cross-domain bridge: app and infotainment to internal bus to physical actuation crosses multiple boundaries and is a reusable pivot.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Reusable across Model 3 on affected firmware given foothold.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Deployment-wide with the prerequisite setup, no per-device physical touch beyond the chain.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recoverable through a firmware update.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk." } }, { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:1/EC:3/EX:1/PH:3/DP:3/AT:4/CH:4/SR:4/SX:3/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "Position requires prior infotainment code execution then adjacency to the Gateway update path.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses update and firmware and device boundaries and is a reusable bridge to persistent control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Firmware trust root", "claim": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Persistent malicious firmware on the control bridge raises recovery cost beyond a single patch action though Tesla shipped a firmware-update fix.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "Position requires prior infotainment code execution then adjacency to the Gateway update path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Standard researcher workflow once positioned, Gateway step but chain-dependent.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Safety-relevant since the compromised ECU governs actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Gateway firmware access can expose proprietary code, configuration, and embedded security material.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses update and firmware and device boundaries and is a reusable bridge to persistent control.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Defeating signature checking is a portable, reusable secret and logic defect applicable across identical units and firmware is supply-chain and trust-mechanism reuse.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "After the prerequisite infotainment foothold is available, the Gateway update-path technique can be repeated across affected vehicles without opening each ECU.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Persistent malicious firmware on the control bridge raises recovery cost beyond a single patch action though Tesla shipped a firmware-update fix.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32156", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:1/EC:3/EX:1/PH:4/DP:3/AT:3/CH:4/SR:3/SX:3/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "Position requires prior privileged foothold on infotainment then lateral move to the Gateway ECU (internal, not open-net).", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Cross-domain bridge: app and infotainment to internal bus to physical actuation crosses multiple boundaries and is a reusable pivot.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recoverable through a firmware update.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "Position requires prior privileged foothold on infotainment then lateral move to the Gateway ECU (internal, not open-net).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The Gateway step itself is low-complexity but reaching it needs the chained foothold is standard-to-advanced researcher workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Gateway compromise exposes vehicle configuration, command, and operational state rather than relying on personal data or a separate perception feed.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The path reaches administrative control over vehicle command functions, but not the gateway signing or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Cross-domain bridge: app and infotainment to internal bus to physical actuation crosses multiple boundaries and is a reusable pivot.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Reusable across Model 3 on affected firmware given foothold.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Deployment-wide with the prerequisite setup, no per-device physical touch beyond the chain.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recoverable through a firmware update.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk." } }, { "id": "firmware-trust-root", "role": "co-dominant", "terminal_type": "FIRMWARE_TRUST_ROOT", "family": "authority", "label": "Firmware trust root", "summary": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:1/EC:3/EX:1/PH:3/DP:3/AT:4/CH:4/SR:4/SX:3/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "Position requires prior infotainment code execution then adjacency to the Gateway update path.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses update and firmware and device boundaries and is a reusable bridge to persistent control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Firmware trust root", "claim": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Persistent malicious firmware on the control bridge raises recovery cost beyond a single patch action though Tesla shipped a firmware-update fix.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "Position requires prior infotainment code execution then adjacency to the Gateway update path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Standard researcher workflow once positioned, Gateway step but chain-dependent.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Safety-relevant since the compromised ECU governs actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Gateway firmware access can expose proprietary code, configuration, and embedded security material.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses update and firmware and device boundaries and is a reusable bridge to persistent control.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Defeating signature checking is a portable, reusable secret and logic defect applicable across identical units and firmware is supply-chain and trust-mechanism reuse.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "After the prerequisite infotainment foothold is available, the Gateway update-path technique can be repeated across affected vehicles without opening each ECU.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Persistent malicious firmware on the control bridge raises recovery cost beyond a single patch action though Tesla shipped a firmware-update fix.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0019" }, { "schema_version": "1.1", "id": "CPATH-2026-0020", "slug": "dji-mavic-3-wi-fi-weak-credentials", "title": "DJI Mavic 3 Wi-Fi Weak Credentials / QuickTransfer Key Derivation (CVE-2023-6951)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2023-6951" ], "vendor": "DJI", "product": "DJI Mavic 3 Wi-Fi Weak Credentials / QuickTransfer Key Derivation (CVE-2023-6951)", "domain": "DRONE_AV", "cvss": [ { "version": "v3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "source": "Nozomi Networks via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 6.6, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1, 2 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "perception-privacy" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "perception-privacy", "role": "dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:2/EC:4/EX:2/PH:0/DP:4/AT:2/CH:2/SR:4/SX:2/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Adjacent Wi-Fi RF proximity plus operator using QuickTransfer.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "QuickTransfer key derivation crosses from the companion app into the drone Wi-Fi network and decrypted operator-device traffic, without demonstrating control authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Firmware update fixes it, no recall and key rotation across fleet.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Adjacent Wi-Fi RF proximity plus operator using QuickTransfer.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single-step PSK derivation from predictable inputs once known.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Access to the drone’s camera and telemetry exposes people and places without directly changing the aircraft’s physical behavior.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded unauthorized access to drone network services, no control-plane and administrator authority, no integrity or availability impact.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "QuickTransfer key derivation crosses from the companion app into the drone Wi-Fi network and decrypted operator-device traffic, without demonstrating control authority.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Weak key derivation is systematic across the affected model and firmware list (shared derivation scheme is portable technique).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "The attacker must be within Wi-Fi range of each drone during QuickTransfer, so collection cannot be launched remotely across the fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Firmware update fixes it, no recall and key rotation across fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state." } }, { "id": "data-privacy", "role": "supporting", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Transferred recordings and exposed service state reveal sensitive personal and proprietary data beyond the live perception stream.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:4/EX:2/PH:0/DP:3/AT:2/CH:2/SR:4/SX:2/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Wi-Fi range and operator QuickTransfer in use.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The derived key crosses the app, drone-network, and radio boundaries to expose traffic and services, but the record does not demonstrate a pivot into flight control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Transferred recordings and exposed service state reveal sensitive personal and proprietary data beyond the live perception stream.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Transferred recordings and exposed service state reveal sensitive personal and proprietary data beyond the live perception stream.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Vendor firmware update remedies.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Wi-Fi range and operator QuickTransfer in use.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The attacker derives the predictable QuickTransfer key, joins the drone network, and then reads reachable traffic or services.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "The captured imagery and telemetry create a privacy consequence without independently driving physical actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Transferred recordings and exposed service state reveal sensitive personal and proprietary data beyond the live perception stream.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded network access to drone services, confidentiality-only, no administrator and firmware and command authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The derived key crosses the app, drone-network, and radio boundaries to expose traffic and services, but the record does not demonstrate a pivot into flight control.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Derivation weakness reusable across affected firmware and models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Proximity-bound per target, not remote fleet mass-exploit.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Vendor firmware update remedies.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Transferred recordings and exposed service state reveal sensitive personal and proprietary data beyond the live perception stream." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6951", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "perception-privacy", "role": "dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:2/EC:4/EX:2/PH:0/DP:4/AT:2/CH:2/SR:4/SX:2/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Adjacent Wi-Fi RF proximity plus operator using QuickTransfer.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "QuickTransfer key derivation crosses from the companion app into the drone Wi-Fi network and decrypted operator-device traffic, without demonstrating control authority.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Firmware update fixes it, no recall and key rotation across fleet.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Adjacent Wi-Fi RF proximity plus operator using QuickTransfer.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single-step PSK derivation from predictable inputs once known.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Access to the drone’s camera and telemetry exposes people and places without directly changing the aircraft’s physical behavior.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Bounded unauthorized access to drone network services, no control-plane and administrator authority, no integrity or availability impact.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "QuickTransfer key derivation crosses from the companion app into the drone Wi-Fi network and decrypted operator-device traffic, without demonstrating control authority.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Weak key derivation is systematic across the affected model and firmware list (shared derivation scheme is portable technique).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "The attacker must be within Wi-Fi range of each drone during QuickTransfer, so collection cannot be launched remotely across the fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Firmware update fixes it, no recall and key rotation across fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Decrypted live video, navigation, and telemetry reveal the drone’s current surroundings and operational world state." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0020" }, { "schema_version": "1.1", "id": "CPATH-2026-0021", "slug": "phantom-of-the-adas-projected-billboard-phantom", "title": "Phantom of the ADAS: Projected/Billboard Phantom Object Attacks on Tesla Autopilot and Mobileye", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [], "vendor": "Tesla", "product": "Phantom of the ADAS: Projected/Billboard Phantom Object Attacks on Tesla Autopilot and Mobileye", "domain": "DRONE_AV", "cvss": [], "unscorable_by_cvss": true, "cvss_facts_confidence": "low", "path_verdict": "CRITICAL", "direction": "UNSCORABLE", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path; citation coverage remains incomplete and independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "perception-to-action" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker needs optical line of sight from a nearby projector or digital billboard to the vehicle camera.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The projected image crosses from the roadside environment into the vehicle camera and then into automatic braking.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Mitigation requires perception hardening and operational controls because no single firmware change removes every physical-world ambiguity.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker needs optical line of sight from a nearby projector or digital billboard to the vehicle camera.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Straightforward operation", "detail": "The demonstrated attack places and times a phantom image with a commodity projector or digital billboard; it does not require vehicle code execution.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The projected object corrupts the camera-derived road model that Autopilot uses to decide when to brake.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Authority is indirect: the attacker does not gain privilege but coerces the vehicle's own control output via spoofed input — (influence over a bounded actuation, no signing and firmware and fleet-control root).", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The projected image crosses from the roadside environment into the vehicle camera and then into automatic braking.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Shared model-level perceptual weakness, fully portable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One phantom source affects all passing affected vehicles but needs per-location optical placement.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Mitigation requires perception hardening and operational controls because no single firmware change removes every physical-world ambiguity.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk." } }, { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Optical line-of-sight (projector and billboard within camera view) is proximity and local-physical-world positioning, not network —.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "As a reusable cross-domain bridge from environment manipulation to vehicle control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "No clean firmware patch removes the ambiguity.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Optical line-of-sight (projector and billboard within camera view) is proximity and local-physical-world positioning, not network —.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Straightforward operation", "detail": "Once optical line of sight is established, a consumer projector or millisecond-long billboard image can create the demonstrated phantom object.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "A convincing phantom object can make the vehicle brake suddenly on a live road; the physical risk follows from the ADAS response to corrupted perception.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The projected image influences the perception pipeline but does not grant software, administrator, or vehicle-control authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "As a reusable cross-domain bridge from environment manipulation to vehicle control.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The perceptual ambiguity is shared across every vehicle of the affected model and software, fully portable, no per-vehicle secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One billboard and projector hits many passing vehicles but requires per-site optical setup and line-of-sight, deployment-wide rather than fully fleet-remote and cloud.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "No clean firmware patch removes the ambiguity.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object." } } ], "sources": [ { "id": "source-citation-pending-public-url", "label": "source citation pending public URL", "publisher": "source citation pending public URL", "kind": "other" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker needs optical line of sight from a nearby projector or digital billboard to the vehicle camera.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The projected image crosses from the roadside environment into the vehicle camera and then into automatic braking.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Mitigation requires perception hardening and operational controls because no single firmware change removes every physical-world ambiguity.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker needs optical line of sight from a nearby projector or digital billboard to the vehicle camera.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Straightforward operation", "detail": "The demonstrated attack places and times a phantom image with a commodity projector or digital billboard; it does not require vehicle code execution.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The projected object corrupts the camera-derived road model that Autopilot uses to decide when to brake.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Authority is indirect: the attacker does not gain privilege but coerces the vehicle's own control output via spoofed input — (influence over a bounded actuation, no signing and firmware and fleet-control root).", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The projected image crosses from the roadside environment into the vehicle camera and then into automatic braking.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Shared model-level perceptual weakness, fully portable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One phantom source affects all passing affected vehicles but needs per-location optical placement.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Mitigation requires perception hardening and operational controls because no single firmware change removes every physical-world ambiguity.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk." } }, { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Optical line-of-sight (projector and billboard within camera view) is proximity and local-physical-world positioning, not network —.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "As a reusable cross-domain bridge from environment manipulation to vehicle control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "No clean firmware patch removes the ambiguity.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Optical line-of-sight (projector and billboard within camera view) is proximity and local-physical-world positioning, not network —.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Straightforward operation", "detail": "Once optical line of sight is established, a consumer projector or millisecond-long billboard image can create the demonstrated phantom object.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "A convincing phantom object can make the vehicle brake suddenly on a live road; the physical risk follows from the ADAS response to corrupted perception.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The projected image influences the perception pipeline but does not grant software, administrator, or vehicle-control authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "As a reusable cross-domain bridge from environment manipulation to vehicle control.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The perceptual ambiguity is shared across every vehicle of the affected model and software, fully portable, no per-vehicle secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One billboard and projector hits many passing vehicles but requires per-site optical setup and line-of-sight, deployment-wide rather than fully fleet-remote and cloud.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "No clean firmware patch removes the ambiguity.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0021" }, { "schema_version": "1.1", "id": "CPATH-2026-0022", "slug": "gps-gnss-spoofing-safe-hijacking-of-consumer", "title": "GPS/GNSS Spoofing Safe-Hijacking of Consumer Drones (Adaptive GPS Spoofing / Tractor Beam class)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [], "vendor": "GNSS (multi-vendor)", "product": "GPS/GNSS Spoofing Safe-Hijacking of Consumer Drones (Adaptive GPS Spoofing / Tractor Beam class)", "domain": "DRONE_AV", "cvss": [], "unscorable_by_cvss": true, "cvss_facts_confidence": "low", "path_verdict": "CRITICAL", "direction": "UNSCORABLE", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path; citation coverage remains incomplete and independent path review is open." }, "dominant_path_ids": [ "perception-to-action", "device-control-safety" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must transmit a stronger spoofed GNSS signal within radio range and line of sight; no network account or drone credential is required.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "RF and physical to perception to control and safety domains.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Fleet-wide recovery is required: root cause is unauthenticated L1 C and A.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must transmit a stronger spoofed GNSS signal within radio range and line of sight; no network account or drone credential is required.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "Adaptive signal shaping requires specialist radio work, but multiple research groups reproduced it with commercial software-defined radio equipment.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Forced fly-away, steering to attacker location, crash and forced landing are credible dangerous actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "No signing and firmware root or fleet control plane is captured.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "RF and physical to perception to control and safety domains.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Technique reuses against any unauthenticated civilian GNSS receiver (no per-device secret).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One spoofer affects all in-range receivers, deployment and area-wide but requires RF setup and proximity, not remote cloud fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Fleet-wide recovery is required: root cause is unauthenticated L1 C and A.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:2/CH:3/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The spoofer must transmit within radio range and line of sight of the target drone.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The forged GNSS signal crosses from the radio environment into navigation state and then into flight control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Recovery requires restoring trusted navigation inputs and confirming the vehicle’s location and route before resuming operation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The spoofer must transmit within radio range and line of sight of the target drone.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible adaptive spoof with SDR.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Manipulated sensitive operational and navigation state feeding control (not exfiltration).", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The attacker influences control through a trusted sensor input without obtaining credentials, operating-system authority, or a firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The forged GNSS signal crosses from the radio environment into navigation state and then into flight control.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same adaptive spoofing method can be reused against civilian receivers that lack authenticated GNSS signals.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Area-wide with RF setup.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Recovery requires restoring trusted navigation inputs and confirming the vehicle’s location and route before resuming operation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence." } } ], "sources": [ { "id": "source-citation-pending-public-url", "label": "source citation pending public URL", "publisher": "source citation pending public URL", "kind": "other" } ], "dominant_paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must transmit a stronger spoofed GNSS signal within radio range and line of sight; no network account or drone credential is required.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "RF and physical to perception to control and safety domains.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Fleet-wide recovery is required: root cause is unauthenticated L1 C and A.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must transmit a stronger spoofed GNSS signal within radio range and line of sight; no network account or drone credential is required.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "Adaptive signal shaping requires specialist radio work, but multiple research groups reproduced it with commercial software-defined radio equipment.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Forced fly-away, steering to attacker location, crash and forced landing are credible dangerous actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "No signing and firmware root or fleet control plane is captured.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "RF and physical to perception to control and safety domains.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Technique reuses against any unauthenticated civilian GNSS receiver (no per-device secret).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One spoofer affects all in-range receivers, deployment and area-wide but requires RF setup and proximity, not remote cloud fleet.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Fleet-wide recovery is required: root cause is unauthenticated L1 C and A.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Spoofed GNSS changes the position estimate trusted by the autopilot, causing the aircraft to act on a false navigation state." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:2/CH:3/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The spoofer must transmit within radio range and line of sight of the target drone.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The forged GNSS signal crosses from the radio environment into navigation state and then into flight control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Recovery requires restoring trusted navigation inputs and confirming the vehicle’s location and route before resuming operation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The spoofer must transmit within radio range and line of sight of the target drone.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible adaptive spoof with SDR.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Manipulated sensitive operational and navigation state feeding control (not exfiltration).", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The attacker influences control through a trusted sensor input without obtaining credentials, operating-system authority, or a firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The forged GNSS signal crosses from the radio environment into navigation state and then into flight control.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same adaptive spoofing method can be reused against civilian receivers that lack authenticated GNSS signals.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Area-wide with RF setup.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Recovery requires restoring trusted navigation inputs and confirming the vehicle’s location and route before resuming operation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Autopilot actions driven by the false position can divert or crash the aircraft, creating a credible dangerous-actuation consequence." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0022" }, { "schema_version": "1.1", "id": "CPATH-2026-0023", "slug": "unitree-unipwn-ble-wi-fi-config-root", "title": "Unitree UniPwn — BLE Wi-Fi config root takeover (Go2/B2/G1/H1)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2025-35027", "CVE-2025-60017", "CVE-2025-60250", "CVE-2025-60251" ], "vendor": "Unitree", "product": "Unitree UniPwn — BLE Wi-Fi config root takeover (Go2/B2/G1/H1)", "domain": "ROBOTICS_HUMANOID", "cvss": [ { "version": "v3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "source": "Takeonme CNA via NVD (CVE-2025-35027)" }, { "version": "v3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H", "source": "MITRE via NVD (CVE-2025-60017)" }, { "version": "v3.1", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "source": "MITRE via NVD (CVE-2025-60250)" }, { "version": "v3.1", "score": 5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "source": "MITRE via NVD (CVE-2025-60251)" } ], "cvss_headline": { "version": "v3.1", "score": 8.2, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "CVE-backed BLE/root condition with separately modeled motion, peer-propagation, and sensor consequences; field exploitation and weaponized motion are not claimed." }, "dominant_path_ids": [ "fleet-control-plane" ], "dominance_reason": "The fleet-control-plane path is dominant because documented peer scanning can reuse the shared key across in-range robots, producing the only fleet-scale EMERGENCY path; motion and privacy remain supporting CRITICAL paths.", "paths": [ { "id": "perception-to-action", "role": "supporting", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "BLE-proximity root authority reaches the perception and motion stack of a mobile robot, creating a modeled embodied-safety path.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:4/EX:2/PH:4/DP:4/AT:3/CH:4/SR:4/SX:2/OR:3/EV:3/LS:ACTIVE", "steps": [ { "id": "ble-proximity-entry", "kind": "access", "label": "BLE-proximity entry", "claim": "The cited CVE records place initial access within BLE proximity or adjacent range of an affected Unitree robot.", "basis": "source", "evidence_refs": [ "nvd", "nvd-2", "nvd-3", "nvd-4" ] }, { "id": "shared-key-root-boundary", "kind": "boundary", "label": "Shared key to root", "claim": "The documented chain combines a shared hardcoded key, weak string authentication, and sudo command injection to cross from BLE setup access to root authority.", "basis": "source", "evidence_refs": [ "nvd", "nvd-2" ] }, { "id": "motion-stack-capability", "kind": "capability", "label": "Root reaches the embodied stack", "claim": "Root authority can reach onboard perception inputs and the motion stack; that is the modeled transition from device compromise to perception-informed actuation.", "basis": "model-inference", "evidence_refs": [] }, { "id": "embodied-safety-consequence", "kind": "consequence", "label": "Mobile-robot safety consequence", "claim": "Unauthorized control of the motion stack on a walking mobile robot can create physical or bystander safety consequences. This is a capability-grounded candidate path; the sources do not establish weaponized motion or field harm.", "basis": "model-inference", "evidence_refs": [] }, { "id": "per-unit-motion-recovery", "kind": "recovery", "label": "Per-unit embodied recovery", "claim": "This path assumes BLE proximity for initial actuation control and vendor firmware remediation with per-unit verification; it does not inherit fleet propagation automatically.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The initial attacker must be within BLE range; the shared key and weak authentication then expose the root command path without a prior account.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The published proof of concept combines the shared BLE key, weak string authentication, and command injection into a reproducible root workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The root workflow is reproducible, but the attacker still has to begin within BLE range of an affected robot.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "A compromised robot can issue motion commands to peers, creating a credible risk of collision or unsafe movement around people.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Onboard perception (LIDAR or spatial map or camera) drives the robot's own actuation, so perception feeds action (the perception-to-action link).", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The reused fleet key grants command authority over reachable robots without exposing the vendor’s firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses RF to device to physical or safety boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Shared key reuses across population.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Initial motion control remains limited to one robot within BLE range; automated peer propagation is assessed in the separate fleet path.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Vendor firmware fix needed but per-unit, not a recall or signing-root rotation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it. This status is recorded for Unitree UniPwn.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Onboard perception (LIDAR or spatial map or camera) drives the robot's own actuation, so perception feeds action (the perception-to-action link)." } }, { "id": "fleet-control-plane", "role": "dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "A compromised robot can scan for in-range peers and reuse the shared key, turning local root entry into repeatable deployment propagation.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:2/EC:4/EX:2/PH:3/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "ble-root-seed", "kind": "access", "label": "Seed robot compromised over BLE", "claim": "The cited records describe BLE-adjacent access that can cross the shared-key authentication boundary and obtain root on an affected seed robot.", "basis": "source", "evidence_refs": [ "nvd", "nvd-2" ] }, { "id": "peer-propagation", "kind": "boundary", "label": "Reusable peer propagation", "claim": "The research record describes a compromised robot scanning for in-range peers and reusing the shared key to infect them; this is peer propagation across nearby robots, not proof of Unitree cloud control.", "basis": "source", "evidence_refs": [ "nvd-2", "nvd-3", "nvd-4" ] }, { "id": "repeatable-fleet-capability", "kind": "capability", "label": "Repeatable root across peers", "claim": "Automated peer scanning removes the need for the attacker to approach every robot personally, so the model assigns fleet-scale reuse and execution to an in-range deployment.", "basis": "model-inference", "evidence_refs": [] }, { "id": "deployment-consequence", "kind": "consequence", "label": "Fleet control plane", "claim": "Repeated root compromise can aggregate control, sensing access, and safety exposure across multiple mobile robots. EMERGENCY denotes that reachable deployment consequence, not confirmed exploitation in the field.", "basis": "model-inference", "evidence_refs": [] }, { "id": "fleet-remediation", "kind": "recovery", "label": "Fleet-wide remediation", "claim": "Recovery requires fleet-wide firmware remediation and coordinated verification because any unpatched peer left in range can preserve the propagation condition.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "One robot must first be reached over BLE; an infected robot can then scan for nearby peers and reuse the shared key without further attacker proximity.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The published proof of concept automates peer discovery and reuse of the shared key after the first robot is compromised.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "Initial access remains limited to BLE range even though an infected robot can automate propagation to nearby peers.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Aggregate of many root-controlled mobile robots reduces safety margin across a deployment.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Operational or firmware state across fleet.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Root authority on each peer (not firmware-update or signing-root).", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Multi-hop reusable cross-domain bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "(shared key across entire population).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "After one nearby robot is compromised, automated scanning and the shared key let it approach additional in-range peers without the attacker visiting each one.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Every affected robot needs patched firmware and coordinated verification because one unpatched peer can preserve the nearby propagation path.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it. This status is recorded for Unitree UniPwn.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because a compromised robot can scan for peers and reuse the shared key, while recovery must cover every reachable robot in the deployment." } }, { "id": "perception-privacy", "role": "supporting", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Root access exposes live camera and microphone streams, LIDAR output, and spatial maps that describe the robot's surroundings.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:2/EC:4/EX:2/PH:0/DP:4/AT:3/CH:3/SR:4/SX:2/OR:3/EV:3/LS:ACTIVE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker first obtains root from within BLE range using the same shared-key weakness as the motion-control path.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "BLE entry crosses into the robot operating system and then into live sensing and stored spatial state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Root access exposes live camera and microphone streams, LIDAR output, and spatial maps that describe the robot's surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Root access exposes live camera and microphone streams, LIDAR output, and spatial maps that describe the robot's surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Affected robots need the vendor firmware fix and per-unit verification that the shared-key entry path is closed.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker first obtains root from within BLE range using the same shared-key weakness as the motion-control path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The published root workflow already exposes the robot operating system; opening camera, microphone, LIDAR, or map data requires no separate exploit.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "This privacy path concerns surveillance through robot sensors; any physical hazard from root-controlled motion is assessed in the separate safety path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Root access exposes live camera and microphone streams, LIDAR output, and spatial maps that describe the robot's surroundings.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker holds operating-system root while collecting sensor data; the path does not claim control of a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "BLE entry crosses into the robot operating system and then into live sensing and stored spatial state.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The shared BLE key and root workflow can be reused across affected robot models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Sensor collection is available on each compromised robot, while initial access to this path remains proximity-bound.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Affected robots need the vendor firmware fix and per-unit verification that the shared-key entry path is closed.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Root access exposes live camera and microphone streams, LIDAR output, and spatial maps that describe the robot's surroundings." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35027", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-2", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60017", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-3", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60250", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-4", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60251", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "fleet-control-plane", "role": "dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "A compromised robot can scan for in-range peers and reuse the shared key, turning local root entry into repeatable deployment propagation.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:2/EC:4/EX:2/PH:3/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:3/LS:ACTIVE", "steps": [ { "id": "ble-root-seed", "kind": "access", "label": "Seed robot compromised over BLE", "claim": "The cited records describe BLE-adjacent access that can cross the shared-key authentication boundary and obtain root on an affected seed robot.", "basis": "source", "evidence_refs": [ "nvd", "nvd-2" ] }, { "id": "peer-propagation", "kind": "boundary", "label": "Reusable peer propagation", "claim": "The research record describes a compromised robot scanning for in-range peers and reusing the shared key to infect them; this is peer propagation across nearby robots, not proof of Unitree cloud control.", "basis": "source", "evidence_refs": [ "nvd-2", "nvd-3", "nvd-4" ] }, { "id": "repeatable-fleet-capability", "kind": "capability", "label": "Repeatable root across peers", "claim": "Automated peer scanning removes the need for the attacker to approach every robot personally, so the model assigns fleet-scale reuse and execution to an in-range deployment.", "basis": "model-inference", "evidence_refs": [] }, { "id": "deployment-consequence", "kind": "consequence", "label": "Fleet control plane", "claim": "Repeated root compromise can aggregate control, sensing access, and safety exposure across multiple mobile robots. EMERGENCY denotes that reachable deployment consequence, not confirmed exploitation in the field.", "basis": "model-inference", "evidence_refs": [] }, { "id": "fleet-remediation", "kind": "recovery", "label": "Fleet-wide remediation", "claim": "Recovery requires fleet-wide firmware remediation and coordinated verification because any unpatched peer left in range can preserve the propagation condition.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "One robot must first be reached over BLE; an infected robot can then scan for nearby peers and reuse the shared key without further attacker proximity.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The published proof of concept automates peer discovery and reuse of the shared key after the first robot is compromised.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "Initial access remains limited to BLE range even though an infected robot can automate propagation to nearby peers.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Aggregate of many root-controlled mobile robots reduces safety margin across a deployment.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Operational or firmware state across fleet.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Root authority on each peer (not firmware-update or signing-root).", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Multi-hop reusable cross-domain bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "(shared key across entire population).", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "After one nearby robot is compromised, automated scanning and the shared key let it approach additional in-range peers without the attacker visiting each one.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Every affected robot needs patched firmware and coordinated verification because one unpatched peer can preserve the nearby propagation path.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Active condition at scoring time", "detail": "The public record did not establish a complete mitigation at scoring time; field exploitation is stated only where a cited source supports it. This status is recorded for Unitree UniPwn.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because a compromised robot can scan for peers and reuse the shared key, while recovery must cover every reachable robot in the deployment." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0023" }, { "schema_version": "1.1", "id": "CPATH-2026-0024", "slug": "unitree-go2-unauthenticated-dds-rce-via-programming", "title": "Unitree Go2 unauthenticated DDS RCE via programming_actuator topic (CVE-2026-27509)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2026-27509" ], "vendor": "Unitree", "product": "Unitree Go2 unauthenticated DDS RCE via programming_actuator topic (CVE-2026-27509)", "domain": "ROBOTICS_HUMANOID", "cvss": [ { "version": "v4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "VulnCheck via NVD" }, { "version": "v3.1", "score": 8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "source": "VulnCheck via NVD" } ], "cvss_headline": { "version": "v4.0", "score": 8.5, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "perception-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:3/EX:2/PH:4/DP:3/AT:3/CH:4/SR:3/SX:3/OR:4/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": " carrying api_id is 1002 arbitrary Python executed as root via subprocess in the actuator_manager path.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses network and device and physical and safety boundaries and remote code execution and persistence is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistence via hotkey-bound scripts surviving reboot, must be manually cleared from and unitree and etc and programming and.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": " carrying api_id is 1002 arbitrary Python executed as root via subprocess in the actuator_manager path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Researcher published full repro, without authentication bypass needed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Root code execution exposes the robot's motion commands, actuator state, and connected sensor state as part of the control path.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Remote code execution reaches operating-system and robot-service authority, including motion control, but not the firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses network and device and physical and safety boundaries and remote code execution and persistence is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Identical flaw reuses across all affected firmware (technique and artifact portability) but no shared secret and key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The exploit must be delivered to each reachable robot; it does not provide a separate fleet orchestration mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistence via hotkey-bound scripts surviving reboot, must be manually cleared from and unitree and etc and programming and.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people." } }, { "id": "perception-privacy", "role": "co-dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:2/EC:3/EX:2/PH:2/DP:4/AT:3/CH:4/SR:3/SX:3/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must reach the robot’s exposed DDS service on the local or deployment network.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Reusable bridge crossing device and cloud and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistence requires manual cleanup.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must reach the robot’s exposed DDS service on the local or deployment network.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The same unauthenticated DDS programming message yields root execution; accessing camera, LIDAR, and spatial state needs no additional vulnerability.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Live sensor access reveals people and surroundings but does not independently command physical motion.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Operating-system root provides sensor access, though this privacy path does not claim a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Reusable bridge crossing device and cloud and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Technique reuses fleet-wide.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The root-and-sensor workflow can be repeated across reachable affected robots after the required network setup.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistence requires manual cleanup.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27509", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:3/EX:2/PH:4/DP:3/AT:3/CH:4/SR:3/SX:3/OR:4/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": " carrying api_id is 1002 arbitrary Python executed as root via subprocess in the actuator_manager path.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses network and device and physical and safety boundaries and remote code execution and persistence is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistence via hotkey-bound scripts surviving reboot, must be manually cleared from and unitree and etc and programming and.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": " carrying api_id is 1002 arbitrary Python executed as root via subprocess in the actuator_manager path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Researcher published full repro, without authentication bypass needed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Root code execution exposes the robot's motion commands, actuator state, and connected sensor state as part of the control path.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Remote code execution reaches operating-system and robot-service authority, including motion control, but not the firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses network and device and physical and safety boundaries and remote code execution and persistence is a reusable bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Identical flaw reuses across all affected firmware (technique and artifact portability) but no shared secret and key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The exploit must be delivered to each reachable robot; it does not provide a separate fleet orchestration mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistence via hotkey-bound scripts surviving reboot, must be manually cleared from and unitree and etc and programming and.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthenticated root execution reaches actuator commands, allowing unsafe robot motion that can endanger nearby people." } }, { "id": "perception-privacy", "role": "co-dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:2/EC:3/EX:2/PH:2/DP:4/AT:3/CH:4/SR:3/SX:3/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must reach the robot’s exposed DDS service on the local or deployment network.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Reusable bridge crossing device and cloud and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Persistence requires manual cleanup.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must reach the robot’s exposed DDS service on the local or deployment network.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The same unauthenticated DDS programming message yields root execution; accessing camera, LIDAR, and spatial state needs no additional vulnerability.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Live sensor access reveals people and surroundings but does not independently command physical motion.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Operating-system root provides sensor access, though this privacy path does not claim a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Reusable bridge crossing device and cloud and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Technique reuses fleet-wide.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The root-and-sensor workflow can be repeated across reachable affected robots after the required network setup.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Persistence requires manual cleanup.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Root execution exposes live camera, LIDAR, navigation, and spatial-sensor data that describe the robot’s surroundings." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0024" }, { "schema_version": "1.1", "id": "CPATH-2026-0025", "slug": "unitree-go2-android-app-database-tampering-rce", "title": "Unitree Go2 Android-app database tampering RCE (CVE-2026-27510)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2026-27510" ], "vendor": "Unitree", "product": "Unitree Go2 Android-app database tampering RCE (CVE-2026-27510)", "domain": "ROBOTICS_HUMANOID", "cvss": [ { "version": "v4.0", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "VulnCheck via NVD" }, { "version": "v3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "source": "VulnCheck via NVD" }, { "version": "v3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "source": "NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.6, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "SIDEWAYS", "requirements_missed": [ 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "perception-privacy" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "device-control-safety", "role": "supporting", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Tampered app database content can lead to root and motion control, enabling unsafe actuation that can endanger nearby people.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:3/EC:2/EX:2/PH:3/DP:3/AT:3/CH:3/SR:3/SX:1/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "The attacker needs an owned rooted Android phone and ADB access to extract, modify, and restore the companion app database.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Crosses app to device and physical to safety boundaries but not a reusable cross-domain key bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "Tampered app database content can lead to root and motion control, enabling unsafe actuation that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Tampered app database content can lead to root and motion control, enabling unsafe actuation that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Real fix is robot-side validation of uploaded Python.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "The attacker needs an owned rooted Android phone and ADB access to extract, modify, and restore the companion app database.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "The attacker needs a rooted Android device, must alter the companion-app database, and then relies on the operator to trigger the modified key binding.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Tampered app database content can lead to root and motion control, enabling unsafe actuation that can endanger nearby people.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Root execution can expose companion-app data, robot configuration, and operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The altered binding reaches root command execution through the robot actuator manager, but it does not compromise a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Crosses app to device and physical to safety boundaries but not a reusable cross-domain key bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The missing robot-side validation is shared across affected units, so the method is reusable even though it does not expose a universal secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Each attempt needs control of a rooted operator phone and the local companion-app workflow; it does not spread automatically between robots.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Real fix is robot-side validation of uploaded Python.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Tampered app database content can lead to root and motion control, enabling unsafe actuation that can endanger nearby people." } }, { "id": "perception-privacy", "role": "dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:3/EC:2/EX:2/PH:1/DP:4/AT:3/CH:2/SR:3/SX:1/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "The attacker needs an owned rooted Android phone and ADB access to inject content through the companion app database.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Enables further access but is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires removing the tampered database, restoring trusted app state, and checking the paired robot for unauthorized changes.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "The attacker needs an owned rooted Android phone and ADB access to inject content through the companion app database.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible-but-advanced gives root on the robot, which grants live camera and sensor access for exfiltration.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Minor physical effect", "detail": "Privacy exfiltration is at most a nuisance to physical safety on this path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Root execution authority enabling the read.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Enables further access but is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Systemic no-validation root cause generalizes across units.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Each sensor-access attempt depends on a rooted operator phone and the local companion-app workflow; there is no automated peer propagation.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires removing the tampered database, restoring trusted app state, and checking the paired robot for unauthorized changes.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27510", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "perception-privacy", "role": "dominant", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:3/EC:2/EX:2/PH:1/DP:4/AT:3/CH:2/SR:3/SX:1/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "The attacker needs an owned rooted Android phone and ADB access to inject content through the companion app database.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "Enables further access but is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires removing the tampered database, restoring trusted app state, and checking the paired robot for unauthorized changes.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "The attacker needs an owned rooted Android phone and ADB access to inject content through the companion app database.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible-but-advanced gives root on the robot, which grants live camera and sensor access for exfiltration.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Minor physical effect", "detail": "Privacy exfiltration is at most a nuisance to physical safety on this path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Root execution authority enabling the read.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "Enables further access but is not a reusable cross-domain authority bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Systemic no-validation root cause generalizes across units.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Each sensor-access attempt depends on a rooted operator phone and the local companion-app workflow; there is no automated peer propagation.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires removing the tampered database, restoring trusted app state, and checking the paired robot for unauthorized changes.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Root execution exposes the robot’s live camera feed and spatial-sensor state, revealing people and places around the device." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0025" }, { "schema_version": "1.1", "id": "CPATH-2026-0026", "slug": "unitree-go1-cloudsail-undocumented-remote-access-backdoor", "title": "Unitree Go1 CloudSail undocumented remote-access backdoor (CVE-2025-2894)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2025-2894" ], "vendor": "Unitree", "product": "Unitree Go1 CloudSail undocumented remote-access backdoor (CVE-2025-2894)", "domain": "ROBOTICS_HUMANOID", "cvss": [ { "version": "v3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "source": "Takeonme CNA via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 6.6, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "fleet-control-plane" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:3/EX:3/PH:4/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:4/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The undocumented remote service is reachable through the vendor cloud path when the shared API authority is available.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses cloud-to-physical-actuation boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Removal requires firmware and service change fleet-wide (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The undocumented remote service is reachable through the vendor cloud path when the shared API authority is available.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "With the shared CloudSail key, the demonstrated service workflow provides repeatable remote shell and motion commands through the robot's outbound tunnel.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Remote root exposes the robot's sensor, configuration, and operational state alongside its motion controls.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The service provides remote motion commands and SSH root on the onboard host; it does not expose a vendor firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses cloud-to-physical-actuation boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same shared CloudSail credential and service workflow can be reused to send motion commands to registered robots.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The shared service path can address registered robots over their outbound tunnels without placing an attacker beside each device.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Removal requires firmware and service change fleet-wide (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the shared remote service and API key can reach many registered robots, and remediation must revoke that fleet-wide authority." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:3/EX:3/PH:4/DP:3/AT:4/CH:4/SR:4/SX:4/OR:4/EV:4/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Robots auto-dial outbound to unitree.com CloudSail, bypassing NAT and firewall, so reachable from internet regardless of inbound filtering.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses cloud and device and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Recovery requires removing the hidden CloudSail functionality across the fleet plus egress filtering and firmware change (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Robots auto-dial outbound to unitree.com CloudSail, bypassing NAT and firewall, so reachable from internet regardless of inbound filtering.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The manufacturer inherently holds it and Makris and Finisterre demonstrated live control (standard workflow, gated only by key possession).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Coordinated remote motion or shutdown across many mobile robots can reduce safety margins across the deployment; observed injury is not asserted.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The shared control plane exposes fleet inventory, robot status, sensor access, and command state across registered devices.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses cloud and device and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One shared API key and hidden service workflow apply across the registered robot population.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The hidden cloud service can address registered robots through their outbound tunnels without per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Recovery requires removing the hidden CloudSail functionality across the fleet plus egress filtering and firmware change (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because one shared API key reaches the remote control plane of many registered robots and requires coordinated fleet remediation." } }, { "id": "perception-privacy", "role": "supporting", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "The shared service can expose live camera feeds and sensor state from registered robots, enabling remote observation of their surroundings.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:4/EC:3/EX:3/PH:2/DP:4/AT:3/CH:3/SR:4/SX:4/OR:4/EV:4/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The undocumented remote service is reachable through the vendor cloud path when the shared API authority is available.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Crosses cloud and device and physical-observation boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "The shared service can expose live camera feeds and sensor state from registered robots, enabling remote observation of their surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "The shared service can expose live camera feeds and sensor state from registered robots, enabling remote observation of their surroundings.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Recovery requires fleet-wide service and firmware removal (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The undocumented remote service is reachable through the vendor cloud path when the shared API authority is available.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Possession of the shared CloudSail key gives the demonstrated service access to live cameras and sensors through the existing outbound tunnel.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Surveillance itself is an information and privacy disruption, not direct actuation harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The shared service can expose live camera feeds and sensor state from registered robots, enabling remote observation of their surroundings.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Sensor and camera access via service authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Crosses cloud and device and physical-observation boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "Shared single key gives fleet-wide remote camera access .", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The same service credential can request sensor access from registered robots remotely rather than requiring per-robot physical proximity.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Recovery requires fleet-wide service and firmware removal (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The shared service can expose live camera feeds and sensor state from registered robots, enabling remote observation of their surroundings." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2894", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:3/EX:3/PH:4/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:4/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The undocumented remote service is reachable through the vendor cloud path when the shared API authority is available.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses cloud-to-physical-actuation boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Removal requires firmware and service change fleet-wide (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The undocumented remote service is reachable through the vendor cloud path when the shared API authority is available.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "With the shared CloudSail key, the demonstrated service workflow provides repeatable remote shell and motion commands through the robot's outbound tunnel.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Remote motion control of a walking quadruped can create a collision or bystander hazard, especially in security-sensitive deployments.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Remote root exposes the robot's sensor, configuration, and operational state alongside its motion controls.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The service provides remote motion commands and SSH root on the onboard host; it does not expose a vendor firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses cloud-to-physical-actuation boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same shared CloudSail credential and service workflow can be reused to send motion commands to registered robots.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The shared service path can address registered robots over their outbound tunnels without placing an attacker beside each device.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Removal requires firmware and service change fleet-wide (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the shared remote service and API key can reach many registered robots, and remediation must revoke that fleet-wide authority." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:3/EX:3/PH:4/DP:3/AT:4/CH:4/SR:4/SX:4/OR:4/EV:4/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Robots auto-dial outbound to unitree.com CloudSail, bypassing NAT and firewall, so reachable from internet regardless of inbound filtering.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses cloud and device and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Firmware or trust-root authority", "claim": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Recovery requires removing the hidden CloudSail functionality across the fleet plus egress filtering and firmware change (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Robots auto-dial outbound to unitree.com CloudSail, bypassing NAT and firewall, so reachable from internet regardless of inbound filtering.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The manufacturer inherently holds it and Makris and Finisterre demonstrated live control (standard workflow, gated only by key possession).", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Coordinated remote motion or shutdown across many mobile robots can reduce safety margins across the deployment; observed injury is not asserted.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The shared control plane exposes fleet inventory, robot status, sensor access, and command state across registered devices.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Firmware or trust-root authority", "detail": "One shared API key was reported to enumerate and control 1,919 registered robots through a hidden remote service.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses cloud and device and physical boundaries.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One shared API key and hidden service workflow apply across the registered robot population.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The hidden cloud service can address registered robots through their outbound tunnels without per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Recovery requires removing the hidden CloudSail functionality across the fleet plus egress filtering and firmware change (fleet-wide recovery is required).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because one shared API key reaches the remote control plane of many registered robots and requires coordinated fleet remediation." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0026" }, { "schema_version": "1.1", "id": "CPATH-2026-0027", "slug": "universal-robots-polyscope-5-dashboard-server-os", "title": "Universal Robots PolyScope 5 Dashboard Server OS command injection (CVE-2026-8153)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2026-8153" ], "vendor": "Universal Robots", "product": "Universal Robots PolyScope 5 Dashboard Server OS command injection (CVE-2026-8153)", "domain": "ROBOTICS_HUMANOID", "cvss": [ { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "CNA via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.8, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "fleet-control-plane", "account-authority" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:4/DP:3/AT:3/CH:4/SR:2/SX:4/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Default-exposed network service.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses network to controller to physical and safety boundaries and bridges into actuation.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Software patch (5.25.1) plus segmentation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Default-exposed network service.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single low-complexity request, without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Controller exposes program logic and operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Arbitrary operating system command execution is service and administrator-level control over the controller and its motion programs (not a signing and firmware-update trust root).", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses network to controller to physical and safety boundaries and bridges into actuation.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The dashboard command technique can be reused against controllers that expose the same unauthenticated service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Scriptable across every reachable controller of same version.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Software patch (5.25.1) plus segmentation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:3/DP:3/AT:3/CH:4/SR:3/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The Dashboard Server is exposed on the controller network by default and accepts the vulnerable request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Cross-domain reusable bridge (one exploit to many controllers).", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patching and segmenting every controller across the deployment (fleet action).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The Dashboard Server is exposed on the controller network by default and accepts the vulnerable request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One reproducible command-injection request reaches the controller operating system; no multi-stage exploit is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Fleet-wide motion influence reduces safety margins across many cells but per-cell severe harm is captured in the safety path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Process and program data across the fleet.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Cross-domain reusable bridge (one exploit to many controllers).", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Shared software version and exploit portability deployment-wide.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The injection request can be scripted across reachable affected controllers without a physical visit to each robot cell.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patching and segmenting every controller across the deployment (fleet action).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:3/CH:3/SR:2/SX:4/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Unauthenticated network surface.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Controller takeover is a strong pivot into both safety and fleet paths.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Software patch plus port and network restriction.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Unauthenticated network surface.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single low-complexity injection.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Availability and workflow disruption of the controller at this terminal (severe actuation harm scored separately).", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Exposes program logic, process data, and connected I and O state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Controller takeover is a strong pivot into both safety and fleet paths.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "Version-shared reachability.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remotely scriptable across reachable targets.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Software patch plus port and network restriction.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8153", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:4/DP:3/AT:3/CH:4/SR:2/SX:4/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Default-exposed network service.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Crosses network to controller to physical and safety boundaries and bridges into actuation.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Software patch (5.25.1) plus segmentation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Default-exposed network service.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single low-complexity request, without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Controller exposes program logic and operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Arbitrary operating system command execution is service and administrator-level control over the controller and its motion programs (not a signing and firmware-update trust root).", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Crosses network to controller to physical and safety boundaries and bridges into actuation.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The dashboard command technique can be reused against controllers that expose the same unauthenticated service.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Scriptable across every reachable controller of same version.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Software patch (5.25.1) plus segmentation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Operating-system command execution can alter the motion of an industrial cobot working near people, creating a credible risk of collision or injury." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:3/DP:3/AT:3/CH:4/SR:3/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The Dashboard Server is exposed on the controller network by default and accepts the vulnerable request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Cross-domain reusable bridge (one exploit to many controllers).", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patching and segmenting every controller across the deployment (fleet action).", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The Dashboard Server is exposed on the controller network by default and accepts the vulnerable request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One reproducible command-injection request reaches the controller operating system; no multi-stage exploit is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Fleet-wide motion influence reduces safety margins across many cells but per-cell severe harm is captured in the safety path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Process and program data across the fleet.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Cross-domain reusable bridge (one exploit to many controllers).", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "Shared software version and exploit portability deployment-wide.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The injection request can be scripted across reachable affected controllers without a physical visit to each robot cell.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patching and segmenting every controller across the deployment (fleet action).", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. The same operating-system command authority can modify programs and controller behavior across every reachable affected robot, without exposing a firmware-signing key." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:3/CH:3/SR:2/SX:4/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Unauthenticated network surface.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Controller takeover is a strong pivot into both safety and fleet paths.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Software patch plus port and network restriction.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Unauthenticated network surface.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Single low-complexity injection.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Availability and workflow disruption of the controller at this terminal (severe actuation harm scored separately).", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Exposes program logic, process data, and connected I and O state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Controller takeover is a strong pivot into both safety and fleet paths.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "Version-shared reachability.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remotely scriptable across reachable targets.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Software patch plus port and network restriction.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. The attacker gains operating-system command authority over the controller and can modify robot programs and configuration, but not the vendor signing root." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0027" }, { "schema_version": "1.1", "id": "CPATH-2026-0028", "slug": "teleoperated-surgical-robot-raven-ii-command-hijacking", "title": "Teleoperated surgical robot (Raven II) command hijacking & E-stop abuse", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [], "vendor": "University of Washington (Raven II)", "product": "Teleoperated surgical robot (Raven II) command hijacking & E-stop abuse", "domain": "ROBOTICS_HUMANOID", "cvss": [], "unscorable_by_cvss": true, "cvss_facts_confidence": "low", "path_verdict": "CRITICAL", "direction": "UNSCORABLE", "requirements_missed": [ 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path; citation coverage remains incomplete and independent path review is open." }, "dominant_path_ids": [ "perception-to-action", "device-control-safety", "device-availability" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:4/DP:4/AT:3/CH:3/SR:3/SX:2/OR:2/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Network intermediary control position on the control path.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The attack crosses from the control network into robot motion and then into the physical surgical environment.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators can abort and re-establish the control link, but restoring trustworthy operation also requires protecting the command channel from repeated interception.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Network intermediary control position on the control path.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "The attacker must first intercept the teleoperation link; once on path, command or feedback injection is straightforward and repeatable.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Manipulated command or feedback state directly drives a patient-manipulating robot, so false control state can create a severe procedural hazard.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The injected packet reaches command authority over robot motion, but not operating-system root or the firmware signing boundary.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The attack crosses from the control network into robot motion and then into the physical surgical environment.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The protocol weakness can recur wherever the same unauthenticated control channel is deployed, but it does not expose a shared key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each attack remains tied to one reachable control link and deployment; there is no fleet mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators can abort and re-establish the control link, but restoring trustworthy operation also requires protecting the command channel from repeated interception.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:3/CH:3/SR:3/SX:2/OR:2/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Network intermediary control position.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The attack crosses from an intercepted network control channel into robot motion at the patient boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators must restore the trusted control link, verify robot state, and determine whether the interrupted procedure can safely continue.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Network intermediary control position.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible intermediary control, simple injection once positioned.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The intercepted channel carries the live command and control state used to move the surgical robot.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The injected packet reaches command authority over robot motion, but not operating-system root or the firmware signing boundary.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The attack crosses from an intercepted network control channel into robot motion at the patient boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The injection method can be reused wherever the same unprotected teleoperation protocol is deployed.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each attack remains tied to one reachable robot-control session and does not provide a fleet execution mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators must restore the trusted control link, verify robot state, and determine whether the interrupted procedure can safely continue.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:2/EC:3/EX:2/PH:3/DP:1/AT:2/CH:2/SR:3/SX:2/OR:2/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker needs an on-path position on the robot’s control network to inject or suppress session traffic.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The packet crosses from the control network into the robot’s safety state, but it does not create a broader reusable authority chain.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators must restore the trusted control link, verify robot state, and decide whether the interrupted procedure can safely resume.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker needs an on-path position on the robot’s control network to inject or suppress session traffic.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Standard once positioned but notably efficient (single packet).", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "This path interrupts the control session and does not depend on reading or changing patient data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Triggering the emergency stop reaches one bounded safety function but does not grant general command, administrator, or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The packet crosses from the control network into the robot’s safety state, but it does not create a broader reusable authority chain.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The denial method is reusable across deployments that use the same unprotected teleoperation protocol.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each interruption requires an on-path position against one active teleoperation link.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators must restore the trusted control link, verify robot state, and decide whether the interrupted procedure can safely resume.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion." } } ], "sources": [ { "id": "source-citation-pending-public-url", "label": "source citation pending public URL", "publisher": "source citation pending public URL", "kind": "other" } ], "dominant_paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:2/EX:2/PH:4/DP:4/AT:3/CH:3/SR:3/SX:2/OR:2/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Network intermediary control position on the control path.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The attack crosses from the control network into robot motion and then into the physical surgical environment.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators can abort and re-establish the control link, but restoring trustworthy operation also requires protecting the command channel from repeated interception.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Network intermediary control position on the control path.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "The attacker must first intercept the teleoperation link; once on path, command or feedback injection is straightforward and repeatable.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Manipulated command or feedback state directly drives a patient-manipulating robot, so false control state can create a severe procedural hazard.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The injected packet reaches command authority over robot motion, but not operating-system root or the firmware signing boundary.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The attack crosses from the control network into robot motion and then into the physical surgical environment.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The protocol weakness can recur wherever the same unauthenticated control channel is deployed, but it does not expose a shared key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each attack remains tied to one reachable control link and deployment; there is no fleet mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators can abort and re-establish the control link, but restoring trustworthy operation also requires protecting the command channel from repeated interception.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The attacker changes the live command and feedback state that the operator and robot use to coordinate surgical motion." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:3/CH:3/SR:3/SX:2/OR:2/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Network intermediary control position.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The attack crosses from an intercepted network control channel into robot motion at the patient boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators must restore the trusted control link, verify robot state, and determine whether the interrupted procedure can safely continue.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Network intermediary control position.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reproducible intermediary control, simple injection once positioned.", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The intercepted channel carries the live command and control state used to move the surgical robot.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The injected packet reaches command authority over robot motion, but not operating-system root or the firmware signing boundary.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The attack crosses from an intercepted network control channel into robot motion at the patient boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The injection method can be reused wherever the same unprotected teleoperation protocol is deployed.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each attack remains tied to one reachable robot-control session and does not provide a fleet execution mechanism.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators must restore the trusted control link, verify robot state, and determine whether the interrupted procedure can safely continue.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Injected surgical-robot commands can produce unintended instrument motion and create a credible risk of patient injury." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:2/EC:3/EX:2/PH:3/DP:1/AT:2/CH:2/SR:3/SX:2/OR:2/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker needs an on-path position on the robot’s control network to inject or suppress session traffic.", "basis": "model-inference", "evidence_refs": [] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The packet crosses from the control network into the robot’s safety state, but it does not create a broader reusable authority chain.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators must restore the trusted control link, verify robot state, and decide whether the interrupted procedure can safely resume.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker needs an on-path position on the robot’s control network to inject or suppress session traffic.", "basis": "model-inference", "evidence_refs": [] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Standard once positioned but notably efficient (single packet).", "basis": "model-inference", "evidence_refs": [] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "This path interrupts the control session and does not depend on reading or changing patient data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Triggering the emergency stop reaches one bounded safety function but does not grant general command, administrator, or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The packet crosses from the control network into the robot’s safety state, but it does not create a broader reusable authority chain.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The denial method is reusable across deployments that use the same unprotected teleoperation protocol.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each interruption requires an on-path position against one active teleoperation link.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators must restore the trusted control link, verify robot state, and decide whether the interrupted procedure can safely resume.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "model-inference", "evidence_refs": [] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "operational-assumption", "evidence_refs": [] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Halting the robot mid-procedure can disrupt care and reduce the operating margin, but the emergency stop is a fail-safe rather than attacker-directed motion." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0028" }, { "schema_version": "1.1", "id": "CPATH-2026-0029", "slug": "hikvision-ip-camera-nvr-unauthenticated-command-injection", "title": "Hikvision IP camera / NVR unauthenticated command injection (CVE-2021-36260)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2021-36260" ], "vendor": "Hikvision", "product": "Hikvision IP camera / NVR unauthenticated command injection (CVE-2021-36260)", "domain": "GENERAL_IOT", "cvss": [ { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD / CNA via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 9.8, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "perception-to-action", "account-authority", "fleet-control-plane" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:4/EC:4/EX:4/PH:3/DP:4/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The vulnerable camera web service was reachable over the network, including on internet-exposed installations, without a prior account.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The request crosses from the network into the camera operating system and then into the human security decisions driven by its feed.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patched firmware, verification that persistence was removed, and reset or credential rotation where compromise is suspected.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The vulnerable camera web service was reachable over the network, including on internet-exposed installations, without a prior account.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A public exploit can inject a command through one unauthenticated HTTP request; no memory-corruption chain is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Suppressing or fabricating a security-camera feed can hide activity from operators and reduce the physical-security margin of the monitored site.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Command injection reaches operating-system control of the camera, including its feed and configuration, but not a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The request crosses from the network into the camera operating system and then into the human security decisions driven by its feed.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same vulnerable handler and exploit method apply across many affected Hikvision camera and recorder models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Internet scanning and public tooling allow the request to be repeated across exposed devices without physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patched firmware, verification that persistence was removed, and reset or credential rotation where compromise is suspected.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "An exposed Hikvision web service accepts the command-injection request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A compromised camera can bridge from its exposed service into the local network, connected services, and stored surveillance data.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Possible implants make recovery more than a password change: devices need patched firmware, reflash or reset, and credential review.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "An exposed Hikvision web service accepts the command-injection request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One public HTTP request is sufficient to obtain operating-system command execution.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Operating-system takeover can interrupt camera availability, while direct physical actuation is outside this authority-focused path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Root access exposes device credentials, configuration, firmware state, and surveillance material stored or processed by the device.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A compromised camera can bridge from its exposed service into the local network, connected services, and stored surveillance data.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The unauthenticated injection primitive is reusable across affected models without obtaining a secret from each device.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Public scanners and exploit code support remote repetition across large numbers of internet-exposed devices.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Possible implants make recovery more than a password change: devices need patched firmware, reflash or reset, and credential review.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because unauthenticated root access is remotely reusable across a large camera population and recovery requires coordinated patching and incident review." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:2/DP:2/AT:2/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Every internet-exposed affected camera presents the same unauthenticated web entry point.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The shared bug turns individual camera compromise into reusable botnet enrollment and command-and-control infrastructure.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Operators must patch, verify, and potentially reflash every exposed device because one compromised node can remain in the botnet.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Every internet-exposed affected camera presents the same unauthenticated web entry point.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Automated public tooling can issue the same command-injection request to each discovered device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Coordinated camera outages or falsified feeds can weaken security monitoring across many sites, without claiming direct actuator control.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Operational data in scope", "detail": "A botnet-scale compromise exposes device inventory, configuration, and operational telemetry across the affected population.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The shared bug turns individual camera compromise into reusable botnet enrollment and command-and-control infrastructure.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One exploit implementation works across the affected product population without a per-device credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Discovery and exploitation can run remotely at internet scale with no visit to each camera.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Operators must patch, verify, and potentially reflash every exposed device because one compromised node can remain in the botnet.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same remote root primitive can be aggregated across many cameras and coordinated recovery extends beyond one device." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36260", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:4/EC:4/EX:4/PH:3/DP:4/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The vulnerable camera web service was reachable over the network, including on internet-exposed installations, without a prior account.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The request crosses from the network into the camera operating system and then into the human security decisions driven by its feed.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patched firmware, verification that persistence was removed, and reset or credential rotation where compromise is suspected.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The vulnerable camera web service was reachable over the network, including on internet-exposed installations, without a prior account.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A public exploit can inject a command through one unauthenticated HTTP request; no memory-corruption chain is required.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Suppressing or fabricating a security-camera feed can hide activity from operators and reduce the physical-security margin of the monitored site.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Command injection reaches operating-system control of the camera, including its feed and configuration, but not a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The request crosses from the network into the camera operating system and then into the human security decisions driven by its feed.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same vulnerable handler and exploit method apply across many affected Hikvision camera and recorder models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Internet scanning and public tooling allow the request to be repeated across exposed devices without physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patched firmware, verification that persistence was removed, and reset or credential rotation where compromise is suspected.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Root access exposes live and stored surveillance video and can change the visual evidence that guards or operators rely on." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "An exposed Hikvision web service accepts the command-injection request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A compromised camera can bridge from its exposed service into the local network, connected services, and stored surveillance data.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Possible implants make recovery more than a password change: devices need patched firmware, reflash or reset, and credential review.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "An exposed Hikvision web service accepts the command-injection request without authentication.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One public HTTP request is sufficient to obtain operating-system command execution.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Operating-system takeover can interrupt camera availability, while direct physical actuation is outside this authority-focused path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Root access exposes device credentials, configuration, firmware state, and surveillance material stored or processed by the device.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker gains root-level service and configuration authority on the camera or recorder, but not the vendor firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A compromised camera can bridge from its exposed service into the local network, connected services, and stored surveillance data.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The unauthenticated injection primitive is reusable across affected models without obtaining a secret from each device.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Public scanners and exploit code support remote repetition across large numbers of internet-exposed devices.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Possible implants make recovery more than a password change: devices need patched firmware, reflash or reset, and credential review.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because unauthenticated root access is remotely reusable across a large camera population and recovery requires coordinated patching and incident review." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:2/DP:2/AT:2/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Every internet-exposed affected camera presents the same unauthenticated web entry point.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The shared bug turns individual camera compromise into reusable botnet enrollment and command-and-control infrastructure.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Operators must patch, verify, and potentially reflash every exposed device because one compromised node can remain in the botnet.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Every internet-exposed affected camera presents the same unauthenticated web entry point.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Automated public tooling can issue the same command-injection request to each discovered device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Coordinated camera outages or falsified feeds can weaken security monitoring across many sites, without claiming direct actuator control.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Operational data in scope", "detail": "A botnet-scale compromise exposes device inventory, configuration, and operational telemetry across the affected population.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The attacker aggregates root access on many cameras; this is not authority over Hikvision's legitimate fleet-management or signing infrastructure.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The shared bug turns individual camera compromise into reusable botnet enrollment and command-and-control infrastructure.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One exploit implementation works across the affected product population without a per-device credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Discovery and exploitation can run remotely at internet scale with no visit to each camera.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Operators must patch, verify, and potentially reflash every exposed device because one compromised node can remain in the botnet.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same remote root primitive can be aggregated across many cameras and coordinated recovery extends beyond one device." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0029" }, { "schema_version": "1.1", "id": "CPATH-2026-0030", "slug": "dahua-ip-camera-vth-vto-authentication-bypass", "title": "Dahua IP camera / VTH / VTO authentication bypass (CVE-2021-33044)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2021-33044", "CVE-2021-33045" ], "vendor": "Dahua", "product": "Dahua IP camera / VTH / VTO authentication bypass (CVE-2021-33044)", "domain": "GENERAL_IOT", "cvss": [ { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD / CNA via NVD (CVE-2021-33044)" }, { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD / CNA via NVD (CVE-2021-33045)" } ], "cvss_headline": { "version": "v3.1", "score": 9.8, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "account-authority" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:3/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The Dahua login service is reachable over the network, and exposed installations can be approached without an existing session.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The bypass crosses from a network login into device administration and then into a physical access-control function.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Affected devices need patched firmware plus a reset and configuration review where unauthorized access may have occurred.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The Dahua login service is reachable over the network, and exposed installations can be approached without an existing session.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A single crafted authentication packet can open an administrator session without valid credentials.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The administrator session exposes access-control state, device configuration, and connected surveillance data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The bypass grants administrator command authority over door and monitoring functions, but not a vendor firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The bypass crosses from a network login into device administration and then into a physical access-control function.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same authentication flaw is present across affected Dahua camera, indoor-monitor, and door-station models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The crafted packet can be repeated remotely against exposed door stations without visiting each installation.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Affected devices need patched firmware plus a reset and configuration review where unauthorized access may have occurred.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the remotely reusable bypass applies across affected cameras and door stations, while recovery requires coordinated deployment work." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:3/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The affected Dahua login port is reachable over the network and can be exposed to the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Administrator access links the network login surface to device configuration, surveillance feeds, and connected physical functions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patched firmware, reset or credential rotation, and verification of configuration across affected installations.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The affected Dahua login port is reachable over the network and can be exposed to the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Public proof-of-concept templates send one crafted packet and do not require a password.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Administrator takeover can disable monitoring or access-control functions, although this path records authority rather than a specific physical event.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The administrator session exposes firmware, configuration, credentials, video, audio, and operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Administrator access links the network login surface to device configuration, surveillance feeds, and connected physical functions.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One bypass technique applies across a large set of Dahua models that share the vulnerable authentication logic.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Network scanning and public templates allow remote repetition across exposed devices without per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patched firmware, reset or credential rotation, and verification of configuration across affected installations.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same remote administrator bypass can be reused across affected devices and requires coordinated credential, configuration, and firmware recovery." } }, { "id": "perception-privacy", "role": "supporting", "terminal_type": "PERCEPTION_PRIVACY", "family": "privacy", "label": "Perception privacy", "summary": "The exposed live video and audio reveal intimate, continuous perception of people and spaces around the device.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_PRIVACY/RE:4/EC:4/EX:4/PH:1/DP:4/AT:2/CH:3/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "A remotely reachable Dahua login service can be opened with the same authentication-bypass packet.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The login bypass crosses the device boundary and delivers live camera or audio output to an unauthorized remote observer.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "The exposed live video and audio reveal intimate, continuous perception of people and spaces around the device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception privacy", "claim": "The exposed live video and audio reveal intimate, continuous perception of people and spaces around the device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Devices need the firmware fix and a reset or session review to restore confidence in feed access.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "A remotely reachable Dahua login service can be opened with the same authentication-bypass packet.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "After the one-packet bypass, viewing a camera or microphone feed uses ordinary administrator functions.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Minor physical effect", "detail": "Viewing a feed is a surveillance and privacy harm; it does not itself actuate a door or create direct injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "The exposed live video and audio reveal intimate, continuous perception of people and spaces around the device.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "This path uses the compromised session to view monitoring feeds; broader administrator commands are assessed separately.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The login bypass crosses the device boundary and delivers live camera or audio output to an unauthorized remote observer.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same bypass and feed-access workflow can be reused across affected Dahua models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "An attacker can repeat feed access across internet-exposed devices without approaching each camera.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Devices need the firmware fix and a reset or session review to restore confidence in feed access.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The exposed live video and audio reveal intimate, continuous perception of people and spaces around the device." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33044", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-2", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33045", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:3/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The Dahua login service is reachable over the network, and exposed installations can be approached without an existing session.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The bypass crosses from a network login into device administration and then into a physical access-control function.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Credible safety consequence", "claim": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Affected devices need patched firmware plus a reset and configuration review where unauthorized access may have occurred.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The Dahua login service is reachable over the network, and exposed installations can be approached without an existing session.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A single crafted authentication packet can open an administrator session without valid credentials.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "On door-station models, administrator access can release a door or disable monitoring, enabling unauthorized entry and reducing site safety.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The administrator session exposes access-control state, device configuration, and connected surveillance data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The bypass grants administrator command authority over door and monitoring functions, but not a vendor firmware-signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The bypass crosses from a network login into device administration and then into a physical access-control function.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same authentication flaw is present across affected Dahua camera, indoor-monitor, and door-station models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The crafted packet can be repeated remotely against exposed door stations without visiting each installation.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Affected devices need patched firmware plus a reset and configuration review where unauthorized access may have occurred.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the remotely reusable bypass applies across affected cameras and door stations, while recovery requires coordinated deployment work." } }, { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:3/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The affected Dahua login port is reachable over the network and can be exposed to the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Administrator access links the network login surface to device configuration, surveillance feeds, and connected physical functions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patched firmware, reset or credential rotation, and verification of configuration across affected installations.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The affected Dahua login port is reachable over the network and can be exposed to the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Public proof-of-concept templates send one crafted packet and do not require a password.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Credible safety consequence", "detail": "Administrator takeover can disable monitoring or access-control functions, although this path records authority rather than a specific physical event.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The administrator session exposes firmware, configuration, credentials, video, audio, and operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The bypass grants administrator and service authority to change configuration and issue device commands, but not signing-root control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Administrator access links the network login surface to device configuration, surveillance feeds, and connected physical functions.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One bypass technique applies across a large set of Dahua models that share the vulnerable authentication logic.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Network scanning and public templates allow remote repetition across exposed devices without per-device physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patched firmware, reset or credential rotation, and verification of configuration across affected installations.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the same remote administrator bypass can be reused across affected devices and requires coordinated credential, configuration, and firmware recovery." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0030" }, { "schema_version": "1.1", "id": "CPATH-2026-0031", "slug": "tp-link-archer-ax21-ax1800-router-unauthenticated", "title": "TP-Link Archer AX21 (AX1800) router unauthenticated command injection (CVE-2023-1389)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2023-1389" ], "vendor": "TP-Link", "product": "TP-Link Archer AX21 (AX1800) router unauthenticated command injection (CVE-2023-1389)", "domain": "GENERAL_IOT", "cvss": [ { "version": "v3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD / CNA via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 8.8, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "account-authority", "fleet-control-plane" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The vulnerable Archer AX21 management service was reachable from the network and was exploited on WAN-exposed routers in the wild.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A compromised gateway bridges the internet-facing service into every downstream client network and enables lateral movement.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Each router needs fixed firmware and a factory reset or compromise review before its gateway state can be trusted again.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The vulnerable Archer AX21 management service was reachable from the network and was exploited on WAN-exposed routers in the wild.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One unauthenticated request is implemented in public exploit frameworks and automated botnet scanners.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Router takeover disrupts connectivity but does not directly control a physical actuator.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Root access exposes gateway credentials, network configuration, and traffic-handling state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A compromised gateway bridges the internet-facing service into every downstream client network and enables lateral movement.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same command-injection primitive applies across the affected Archer AX21 firmware population.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Botnet scanners can enroll exposed routers remotely without a per-device secret or physical visit.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Each router needs fixed firmware and a factory reset or compromise review before its gateway state can be trusted again.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the remote root exploit was used by Mirai at scale across exposed routers and recovery requires coordinated patching or replacement." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The attacker controls a large population of rooted gateways through botnet command and control.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:2/DP:2/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "WAN-exposed affected routers can be found and reached directly from the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "One router flaw becomes a distributed control plane that spans customer networks and the public internet.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker controls a large population of rooted gateways through botnet command and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "The attacker controls a large population of rooted gateways through botnet command and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Operators must patch and reset each enrolled router; leaving one node compromised preserves botnet access at that site.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "WAN-exposed affected routers can be found and reached directly from the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Automated scanners issue the same public command-injection request to each discovered router.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Large-scale router compromise can interrupt connectivity, while direct physical harm is outside this path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Operational data in scope", "detail": "The botnet gains device inventory, network position, and operational telemetry from enrolled gateways.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker controls a large population of rooted gateways through botnet command and control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "One router flaw becomes a distributed control plane that spans customer networks and the public internet.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "A single portable exploit implementation works across the affected router population.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remote scanning and exploitation enroll routers at fleet scale without local setup.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Operators must patch and reset each enrolled router; leaving one node compromised preserves botnet access at that site.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because botnet command and control aggregates the reusable router exploit across a large exposed population." } }, { "id": "data-privacy", "role": "supporting", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Gateway control exposes credentials and sensitive traffic from every client that routes through the compromised device.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "This path begins with the same internet-reachable command-injection service on the gateway.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The gateway compromise crosses from device administration into the data plane of all connected clients.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Gateway control exposes credentials and sensitive traffic from every client that routes through the compromised device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Gateway control exposes credentials and sensitive traffic from every client that routes through the compromised device.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Restoration requires fixed firmware, reset of the gateway, and review of DNS, routing, and exposed credentials.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "This path begins with the same internet-reachable command-injection service on the gateway.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Once root is obtained, changing DNS, routing, or packet handling to intercept client traffic is a routine administrator operation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Traffic interception is a confidentiality and integrity harm, not direct physical actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Gateway control exposes credentials and sensitive traffic from every client that routes through the compromised device.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Root authority over routing and DNS lets the attacker redirect or observe downstream communications.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The gateway compromise crosses from device administration into the data plane of all connected clients.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same router exploit and interception setup can be reused across affected devices.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Each remotely compromised gateway exposes the traffic of its attached network, allowing broad repeated collection.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Restoration requires fixed firmware, reset of the gateway, and review of DNS, routing, and exposed credentials.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Gateway control exposes credentials and sensitive traffic from every client that routes through the compromised device." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:4/EX:4/PH:2/DP:3/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The vulnerable Archer AX21 management service was reachable from the network and was exploited on WAN-exposed routers in the wild.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A compromised gateway bridges the internet-facing service into every downstream client network and enables lateral movement.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Each router needs fixed firmware and a factory reset or compromise review before its gateway state can be trusted again.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The vulnerable Archer AX21 management service was reachable from the network and was exploited on WAN-exposed routers in the wild.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "One unauthenticated request is implemented in public exploit frameworks and automated botnet scanners.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Router takeover disrupts connectivity but does not directly control a physical actuator.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Root access exposes gateway credentials, network configuration, and traffic-handling state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker obtains root administration of the gateway and its routing, DNS, and command surface, but not TP-Link's signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A compromised gateway bridges the internet-facing service into every downstream client network and enables lateral movement.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same command-injection primitive applies across the affected Archer AX21 firmware population.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Botnet scanners can enroll exposed routers remotely without a per-device secret or physical visit.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Each router needs fixed firmware and a factory reset or compromise review before its gateway state can be trusted again.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because the remote root exploit was used by Mirai at scale across exposed routers and recovery requires coordinated patching or replacement." } }, { "id": "fleet-control-plane", "role": "co-dominant", "terminal_type": "FLEET_CONTROL_PLANE", "family": "systemic", "label": "Fleet control plane", "summary": "The attacker controls a large population of rooted gateways through botnet command and control.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:FLEET_CONTROL_PLANE/RE:4/EC:4/EX:4/PH:2/DP:2/AT:3/CH:4/SR:4/SX:4/OR:3/EV:4/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "WAN-exposed affected routers can be found and reached directly from the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "One router flaw becomes a distributed control plane that spans customer networks and the public internet.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The attacker controls a large population of rooted gateways through botnet command and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Fleet control plane", "claim": "The attacker controls a large population of rooted gateways through botnet command and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Operators must patch and reset each enrolled router; leaving one node compromised preserves botnet access at that site.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "WAN-exposed affected routers can be found and reached directly from the internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Automated scanners issue the same public command-injection request to each discovered router.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Large-scale router compromise can interrupt connectivity, while direct physical harm is outside this path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Operational data in scope", "detail": "The botnet gains device inventory, network position, and operational telemetry from enrolled gateways.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker controls a large population of rooted gateways through botnet command and control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "One router flaw becomes a distributed control plane that spans customer networks and the public internet.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "A single portable exploit implementation works across the affected router population.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Remote scanning and exploitation enroll routers at fleet scale without local setup.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Operators must patch and reset each enrolled router; leaving one node compromised preserves botnet access at that site.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Field-confirmed evidence", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "uplift", "reason": "The CRITICAL base band rises to EMERGENCY because botnet command and control aggregates the reusable router exploit across a large exposed population." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0031" }, { "schema_version": "1.1", "id": "CPATH-2026-0032", "slug": "moxa-pt-eds-industrial-ethernet-switch-authentication", "title": "Moxa PT/EDS industrial Ethernet switch authentication bypass (CVE-2024-12297)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-12297" ], "vendor": "Moxa", "product": "Moxa PT/EDS industrial Ethernet switch authentication bypass (CVE-2024-12297)", "domain": "GENERAL_IOT", "cvss": [ { "version": "v4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "Moxa PSIRT via NVD" } ], "cvss_headline": { "version": "v4.0", "score": 9.2, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "HIGH", "direction": "OVER", "requirements_missed": [ 2 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "account-authority", "device-availability", "data-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, HIGH; no array-order tie-break is applied.", "paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:2/EX:2/PH:2/DP:3/AT:3/CH:4/SR:3/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The authentication check sits on the switch management interface and is reachable wherever that OT management network is exposed.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "An administrative foothold on the switch can pivot across OT segments and change how control traffic is forwarded.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovery is a firmware update and configuration verification, usually scheduled through constrained industrial maintenance windows.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The authentication check sits on the switch management interface and is reachable wherever that OT management network is exposed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Forging the accepted hash requires brute force or an MD5-collision technique, making this a specialist but repeatable workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Switch administration can disrupt industrial communications, but it does not directly command a physical actuator.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Administrator access exposes switch configuration, firmware state, and sensitive operational details about the control network.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "An administrative foothold on the switch can pivot across OT segments and change how control traffic is forwarded.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The hash-forgery technique applies across the affected PT and EDS switch models without a universal secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The technique can be repeated across reachable switches, but each site's management plane and hash work must be handled.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovery is a firmware update and configuration verification, usually scheduled through constrained industrial maintenance windows.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:2/EX:2/PH:2/DP:1/AT:3/CH:3/SR:3/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The attacker must reach the industrial switch management interface on the control network.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "One compromised switch can propagate an outage into multiple connected OT devices and network segments.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators can restore configuration and apply fixed firmware during an approved OT maintenance window.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The attacker must reach the industrial switch management interface on the control network.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "The same brute-force or MD5-collision work is required before disruptive configuration changes can be made.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "This disruption-focused path does not depend on extracting sensitive process data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Configuration authority is sufficient to change ports, forwarding, and availability of the switch.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "One compromised switch can propagate an outage into multiple connected OT devices and network segments.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The bypass method is reusable across affected Moxa models after site-specific setup.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "A deployment can contain many affected switches, but each reachable management plane must be targeted.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators can restore configuration and apply fixed firmware during an approved OT maintenance window.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:2/EX:2/PH:0/DP:3/AT:3/CH:3/SR:3/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The switch management interface must be reachable from the attacker's network position.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Mirrored OT traffic can reveal credentials and protocols that support later movement into connected control systems.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Fixed firmware and verified switch configuration restore this path; captured credentials may need separate rotation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The switch management interface must be reachable from the attacker's network position.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Brute force or MD5-collision work is needed to bypass authentication before traffic mirroring can be configured.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Passive traffic collection does not directly change industrial actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Switch configuration authority lets the attacker create mirror ports and redirect traffic for observation.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Mirrored OT traffic can reveal credentials and protocols that support later movement into connected control systems.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The same bypass and mirroring workflow can be reused across the affected switch models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Collection can cover each reachable site after its management plane is accessed and configured.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Fixed firmware and verified switch configuration restore this path; captured credentials may need separate rotation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12297", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:4/EC:2/EX:2/PH:2/DP:3/AT:3/CH:4/SR:3/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The authentication check sits on the switch management interface and is reachable wherever that OT management network is exposed.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "An administrative foothold on the switch can pivot across OT segments and change how control traffic is forwarded.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Administrative or command authority", "claim": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovery is a firmware update and configuration verification, usually scheduled through constrained industrial maintenance windows.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The authentication check sits on the switch management interface and is reachable wherever that OT management network is exposed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Forging the accepted hash requires brute force or an MD5-collision technique, making this a specialist but repeatable workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Switch administration can disrupt industrial communications, but it does not directly command a physical actuator.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Administrator access exposes switch configuration, firmware state, and sensitive operational details about the control network.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "An administrative foothold on the switch can pivot across OT segments and change how control traffic is forwarded.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The hash-forgery technique applies across the affected PT and EDS switch models without a universal secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "The technique can be repeated across reachable switches, but each site's management plane and hash work must be handled.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovery is a firmware update and configuration verification, usually scheduled through constrained industrial maintenance windows.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The bypass grants administration of forwarding and device settings, but not a Moxa signing key or firmware trust root." } }, { "id": "device-availability", "role": "co-dominant", "terminal_type": "DEVICE_AVAILABILITY", "family": "recovery", "label": "Device availability and recovery", "summary": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:4/EC:2/EX:2/PH:2/DP:1/AT:3/CH:3/SR:3/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The attacker must reach the industrial switch management interface on the control network.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "One compromised switch can propagate an outage into multiple connected OT devices and network segments.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device availability and recovery", "claim": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Operators can restore configuration and apply fixed firmware during an approved OT maintenance window.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The attacker must reach the industrial switch management interface on the control network.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "The same brute-force or MD5-collision work is required before disruptive configuration changes can be made.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Low-sensitivity state", "detail": "This disruption-focused path does not depend on extracting sensitive process data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Configuration authority is sufficient to change ports, forwarding, and availability of the switch.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "One compromised switch can propagate an outage into multiple connected OT devices and network segments.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The bypass method is reusable across affected Moxa models after site-specific setup.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "A deployment can contain many affected switches, but each reachable management plane must be targeted.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Operators can restore configuration and apply fixed firmware during an approved OT maintenance window.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Changing or disabling switch configuration can interrupt communications needed by industrial monitoring and control." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:2/EX:2/PH:0/DP:3/AT:3/CH:3/SR:3/SX:3/OR:2/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The switch management interface must be reachable from the attacker's network position.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "Mirrored OT traffic can reveal credentials and protocols that support later movement into connected control systems.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Fixed firmware and verified switch configuration restore this path; captured credentials may need separate rotation.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The switch management interface must be reachable from the attacker's network position.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Brute force or MD5-collision work is needed to bypass authentication before traffic mirroring can be configured.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Passive traffic collection does not directly change industrial actuation.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Switch configuration authority lets the attacker create mirror ports and redirect traffic for observation.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "Mirrored OT traffic can reveal credentials and protocols that support later movement into connected control systems.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The same bypass and mirroring workflow can be reused across the affected switch models.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Collection can cover each reachable site after its management plane is accessed and configured.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Fixed firmware and verified switch configuration restore this path; captured credentials may need separate rotation.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. Port mirroring can expose control-network traffic, device configuration, credentials, and proprietary process state." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0032" }, { "schema_version": "1.1", "id": "CPATH-2026-0033", "slug": "chirp-systems-chirp-access-smart-lock-app", "title": "Chirp Systems / Chirp Access smart-lock app hardcoded credentials (CVE-2024-2197)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2024-2197" ], "vendor": "Chirp Systems", "product": "Chirp Systems / Chirp Access smart-lock app hardcoded credentials (CVE-2024-2197)", "domain": "GENERAL_IOT", "cvss": [ { "version": "v4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "source": "CISA/ICS-CERT via NVD" }, { "version": "v3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "source": "CISA/ICS-CERT via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 4.3, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "HIGH", "direction": "UNDER", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "account-authority", "device-control-safety" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, HIGH; no array-order tie-break is applied.", "paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:3/EC:4/EX:3/PH:2/DP:3/AT:2/CH:3/SR:4/SX:3/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "Anyone can download the Chirp Access app and extract its embedded static credential without touching a resident's device.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A public app artifact yields a credential that crosses into deployed access-control beacon configuration.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The vendor must remove and rotate the embedded secret across the app and affected beacon population.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "Anyone can download the Chirp Access app and extract its embedded static credential without touching a resident's device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The credential is stored in the app artifact, so extraction is a straightforward inspection task.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Beacon configuration can affect an access-control installation, but the confirmed evidence does not show remote door unlock or severe physical harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed value is a shared production credential for beacon and backend configuration functions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A public app artifact yields a credential that crosses into deployed access-control beacon configuration.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same embedded secret appears across app installations, so one extraction produces a portable credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Knowledge of the secret is deployment-wide, while applying it to a beacon still requires local radio proximity.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The vendor must remove and rotate the embedded secret across the app and affected beacon population.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:3/EX:2/PH:2/DP:3/AT:2/CH:2/SR:4/SX:2/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Changing an installed beacon requires BLE proximity even after the shared application credential is known.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The embedded app credential crosses the BLE boundary into one deployed beacon.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The install base needs updated app or firmware material that removes and rotates the shared credential.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Changing an installed beacon requires BLE proximity even after the shared application credential is known.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Once nearby, the attacker can use the recovered credential through the ordinary beacon-configuration workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The path changes operational configuration of an access-control beacon rather than extracting resident data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Authority is limited to the exposed beacon settings and does not include lock commands, administrator control, or firmware signing.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The embedded app credential crosses the BLE boundary into one deployed beacon.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same shared credential can be presented to any affected beacon.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each target beacon must be approached over BLE, so execution remains proximity-bound.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The install base needs updated app or firmware material that removes and rotates the shared credential.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2197", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:3/EC:4/EX:3/PH:2/DP:3/AT:2/CH:3/SR:4/SX:3/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Reusable artifact or reachable service", "claim": "Anyone can download the Chirp Access app and extract its embedded static credential without touching a resident's device.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A public app artifact yields a credential that crosses into deployed access-control beacon configuration.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The vendor must remove and rotate the embedded secret across the app and affected beacon population.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Reusable artifact or reachable service", "detail": "Anyone can download the Chirp Access app and extract its embedded static credential without touching a resident's device.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "The credential is stored in the app artifact, so extraction is a straightforward inspection task.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "Beacon configuration can affect an access-control installation, but the confirmed evidence does not show remote door unlock or severe physical harm.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed value is a shared production credential for beacon and backend configuration functions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A public app artifact yields a credential that crosses into deployed access-control beacon configuration.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same embedded secret appears across app installations, so one extraction produces a portable credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "Knowledge of the secret is deployment-wide, while applying it to a beacon still requires local radio proximity.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The vendor must remove and rotate the embedded secret across the app and affected beacon population.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The credential reaches bounded beacon configuration functions; it does not grant fleet administration or a firmware-signing root." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:3/EX:2/PH:2/DP:3/AT:2/CH:2/SR:4/SX:2/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "Changing an installed beacon requires BLE proximity even after the shared application credential is known.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The embedded app credential crosses the BLE boundary into one deployed beacon.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Operational safety effect", "claim": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The install base needs updated app or firmware material that removes and rotates the shared credential.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "Changing an installed beacon requires BLE proximity even after the shared application credential is known.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Once nearby, the attacker can use the recovered credential through the ordinary beacon-configuration workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The path changes operational configuration of an access-control beacon rather than extracting resident data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Authority is limited to the exposed beacon settings and does not include lock commands, administrator control, or firmware signing.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The embedded app credential crosses the BLE boundary into one deployed beacon.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same shared credential can be presented to any affected beacon.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each target beacon must be approached over BLE, so execution remains proximity-bound.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The install base needs updated app or firmware material that removes and rotates the shared credential.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The confirmed effect is bounded beacon reconfiguration; a reported remote-unlock claim was retracted and is not used here." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0033" }, { "schema_version": "1.1", "id": "CPATH-2026-0034", "slug": "august-smart-lock-pro-connect-wi-fi", "title": "August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2019-17098" ], "vendor": "August", "product": "August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098)", "domain": "GENERAL_IOT", "cvss": [ { "version": "v3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "source": "NVD" }, { "version": "v3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "source": "Bitdefender via NVD" } ], "cvss_headline": { "version": "v3.1", "score": 6.5, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "HIGH", "direction": "UNDER", "requirements_missed": [ 1, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "data-privacy" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, HIGH.", "paths": [ { "id": "data-privacy", "role": "dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:3/EX:2/PH:0/DP:3/AT:2/CH:3/SR:4/SX:2/OR:3/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A provisioning disclosure becomes a credential that can bridge into other systems on the home network.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The demonstrated workflow captures setup traffic, reverses ROT13, and decrypts it with the static application key.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Disclosure of the Wi-Fi password does not itself actuate the smart lock.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The password grants access to the victim network but does not directly grant lock administration or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A provisioning disclosure becomes a credential that can bridge into other systems on the home network.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The static decryption key is shared across the product line, so the decryption method is portable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each password still requires a nearby capture during that household's setup window despite the shared key.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17098", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "data-privacy", "role": "dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:3/EX:2/PH:0/DP:3/AT:2/CH:3/SR:4/SX:2/OR:3/EV:3/LS:HISTORICAL", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "A provisioning disclosure becomes a credential that can bridge into other systems on the home network.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "The demonstrated workflow captures setup traffic, reverses ROT13, and decrypts it with the static application key.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Disclosure of the Wi-Fi password does not itself actuate the smart lock.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The password grants access to the victim network but does not directly grant lock administration or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "A provisioning disclosure becomes a credential that can bridge into other systems on the home network.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The static decryption key is shared across the product line, so the decryption method is portable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each password still requires a nearby capture during that household's setup window despite the shared key.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Historical condition", "detail": "The condition is retained as a historical case rather than a claim of current field exposure.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0034" }, { "schema_version": "1.1", "id": "CPATH-2026-0035", "slug": "medtronic-conexus-rf-telemetry-protocol-lacks-authentication", "title": "Medtronic Conexus RF telemetry protocol lacks authentication/encryption (implantable cardiac devices)", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2019-6538", "CVE-2019-6540" ], "vendor": "Medtronic", "product": "Medtronic Conexus RF telemetry protocol lacks authentication/encryption (implantable cardiac devices)", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "source": "CISA/ICS-CERT via NVD (CVE-2019-6538)" }, { "version": "v3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "source": "NVD (CVE-2019-6538)" }, { "version": "v3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "source": "CISA/ICS-CERT via NVD / NVD (CVE-2019-6540)" } ], "cvss_headline": { "version": "v3.1", "score": 9.3, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "SIDEWAYS", "requirements_missed": [ 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "data-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:3/CH:3/SR:3/SX:2/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The implant must be in its short-range Conexus listening state, placing the attacker nearby with suitable radio equipment.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "An unauthenticated radio session crosses into implant memory and settings and then into delivered cardiac therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Legacy implants may need model-wide mitigations, clinical follow-up, or replacement because a simple remote patch is not always available.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The implant must be in its short-range Conexus listening state, placing the attacker nearby with suitable radio equipment.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Researchers demonstrated the protocol workflow, but it requires specialist radio equipment and knowledge of the implant telemetry format.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The same session exposes patient health, device memory, therapy settings, and operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The protocol grants command and configuration access to exposed implant functions, but not a Medtronic firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "An unauthenticated radio session crosses into implant memory and settings and then into delivered cardiac therapy.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The protocol weakness and research technique are portable across affected Conexus device families.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each implant must be approached within radio range while listening; there is no remote fleet execution channel.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Legacy implants may need model-wide mitigations, clinical follow-up, or replacement because a simple remote patch is not always available.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves residual exposure", "detail": "Mitigation reduces the path, but rollout coverage or remaining exposed devices is not independently verified by this registry.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:2/EX:2/PH:2/DP:3/AT:2/CH:2/SR:3/SX:2/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be near an implant while its short-range Conexus telemetry channel is listening.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The radio channel crosses the implant boundary and delivers sensitive clinical and device state to an unauthorized observer.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Protocol-level mitigation must cover the affected product family, while some legacy implants cannot receive an ordinary software update.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be near an implant while its short-range Conexus telemetry channel is listening.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Intercepting or modifying the unencrypted protocol requires the same specialist radio setup demonstrated by researchers.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "This path concerns telemetry confidentiality and integrity; direct therapy manipulation is assessed in the separate safety path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Observation and manipulation are bounded to the active telemetry session rather than implant firmware administration.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The radio channel crosses the implant boundary and delivers sensitive clinical and device state to an unauthorized observer.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The protocol analysis can be reused across affected Conexus devices without learning a unique cryptographic key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Every collection attempt remains limited to one nearby implant in a listening state.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Protocol-level mitigation must cover the affected product family, while some legacy implants cannot receive an ordinary software update.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves residual exposure", "detail": "Mitigation reduces the path, but rollout coverage or remaining exposed devices is not independently verified by this registry.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6538", "publisher": "NVD", "kind": "advisory" }, { "id": "nvd-2", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6540", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:3/CH:3/SR:3/SX:2/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The implant must be in its short-range Conexus listening state, placing the attacker nearby with suitable radio equipment.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "An unauthenticated radio session crosses into implant memory and settings and then into delivered cardiac therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Legacy implants may need model-wide mitigations, clinical follow-up, or replacement because a simple remote patch is not always available.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The implant must be in its short-range Conexus listening state, placing the attacker nearby with suitable radio equipment.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Researchers demonstrated the protocol workflow, but it requires specialist radio equipment and knowledge of the implant telemetry format.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The same session exposes patient health, device memory, therapy settings, and operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The protocol grants command and configuration access to exposed implant functions, but not a Medtronic firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "An unauthenticated radio session crosses into implant memory and settings and then into delivered cardiac therapy.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The protocol weakness and research technique are portable across affected Conexus device families.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each implant must be approached within radio range while listening; there is no remote fleet execution channel.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Legacy implants may need model-wide mitigations, clinical follow-up, or replacement because a simple remote patch is not always available.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves residual exposure", "detail": "Mitigation reduces the path, but rollout coverage or remaining exposed devices is not independently verified by this registry.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthenticated memory and setting changes can alter pacemaker or defibrillator therapy and create a severe wrong-therapy consequence." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:2/EX:2/PH:2/DP:3/AT:2/CH:2/SR:3/SX:2/OR:4/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be near an implant while its short-range Conexus telemetry channel is listening.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The radio channel crosses the implant boundary and delivers sensitive clinical and device state to an unauthorized observer.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Protocol-level mitigation must cover the affected product family, while some legacy implants cannot receive an ordinary software update.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be near an implant while its short-range Conexus telemetry channel is listening.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Intercepting or modifying the unencrypted protocol requires the same specialist radio setup demonstrated by researchers.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "This path concerns telemetry confidentiality and integrity; direct therapy manipulation is assessed in the separate safety path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "Observation and manipulation are bounded to the active telemetry session rather than implant firmware administration.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The radio channel crosses the implant boundary and delivers sensitive clinical and device state to an unauthorized observer.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The protocol analysis can be reused across affected Conexus devices without learning a unique cryptographic key.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Every collection attempt remains limited to one nearby implant in a listening state.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Protocol-level mitigation must cover the affected product family, while some legacy implants cannot receive an ordinary software update.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves residual exposure", "detail": "Mitigation reduces the path, but rollout coverage or remaining exposed devices is not independently verified by this registry.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unencrypted telemetry exposes patient health information, device state, and treatment settings and can be replayed or modified." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0035" }, { "schema_version": "1.1", "id": "CPATH-2026-0036", "slug": "medtronic-minimed-508-paradigm-insulin-pumps-unauthenticated", "title": "Medtronic MiniMed 508 / Paradigm insulin pumps - unauthenticated RF allows insulin delivery control", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2019-10964" ], "vendor": "Medtronic", "product": "Medtronic MiniMed 508 / Paradigm insulin pumps - unauthenticated RF allows insulin delivery control", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H", "source": "CISA/ICS-CERT via NVD" }, { "version": "v3.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD" } ], "cvss_headline": { "version": "v3.0", "score": 8.8, "severity": "HIGH" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1, 2, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "data-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:3/CH:3/SR:4/SX:2/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be within range of the pump's proprietary radio; the interface is not reachable from the public internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The unauthenticated radio message crosses into pump command handling and then into insulin delivery to the patient.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The mitigation program required patient guidance and migration or replacement of affected legacy pump models.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be within range of the pump's proprietary radio; the interface is not reachable from the public internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Issuing delivery commands requires specialist radio equipment and protocol knowledge, but researchers reproduced the workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The command path carries dosing, treatment, and pump operational state used to control insulin delivery.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Without authentication, an in-range transmitter can issue commands as a legitimate controller, but it does not gain a signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The unauthenticated radio message crosses into pump command handling and then into insulin delivery to the patient.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same unauthenticated protocol behavior is shared across the affected MiniMed and Paradigm product family.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each pump must be approached within radio range; the technique does not provide remote fleet control.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The mitigation program required patient guidance and migration or replacement of affected legacy pump models.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:2/EX:2/PH:0/DP:3/AT:2/CH:2/SR:4/SX:2/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be near the pump and able to receive its proprietary radio transmissions.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The unauthenticated radio channel moves sensitive treatment state outside the pump boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Eliminating the legacy protocol exposure requires the product-family mitigation or replacement program, not a session reset.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be near the pump and able to receive its proprietary radio transmissions.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reading the traffic requires the same specialist protocol and radio setup used for the command path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Passive interception does not alter insulin delivery; therapy manipulation is assessed in the separate safety path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "This path is limited to reading exposed radio data and does not grant configuration or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The unauthenticated radio channel moves sensitive treatment state outside the pump boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One protocol implementation can be reused to observe affected pumps across the same product family.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each interception requires proximity to an individual patient and pump.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Eliminating the legacy protocol exposure requires the product-family mitigation or replacement program, not a session reset.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Radio traffic reveals patient treatment, dosing, and pump operational state." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10964", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:2/EX:2/PH:4/DP:3/AT:3/CH:3/SR:4/SX:2/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be within range of the pump's proprietary radio; the interface is not reachable from the public internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The unauthenticated radio message crosses into pump command handling and then into insulin delivery to the patient.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The mitigation program required patient guidance and migration or replacement of affected legacy pump models.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be within range of the pump's proprietary radio; the interface is not reachable from the public internet.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Issuing delivery commands requires specialist radio equipment and protocol knowledge, but researchers reproduced the workflow.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The command path carries dosing, treatment, and pump operational state used to control insulin delivery.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "Without authentication, an in-range transmitter can issue commands as a legitimate controller, but it does not gain a signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The unauthenticated radio message crosses into pump command handling and then into insulin delivery to the patient.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same unauthenticated protocol behavior is shared across the affected MiniMed and Paradigm product family.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each pump must be approached within radio range; the technique does not provide remote fleet control.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The mitigation program required patient guidance and migration or replacement of affected legacy pump models.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Unauthorized insulin changes can cause hypoglycemia, hyperglycemia, or ketoacidosis and can become life-threatening." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:2/EX:2/PH:0/DP:3/AT:2/CH:2/SR:4/SX:2/OR:4/EV:2/LS:MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be near the pump and able to receive its proprietary radio transmissions.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The unauthenticated radio channel moves sensitive treatment state outside the pump boundary.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Eliminating the legacy protocol exposure requires the product-family mitigation or replacement program, not a session reset.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be near the pump and able to receive its proprietary radio transmissions.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "Reading the traffic requires the same specialist protocol and radio setup used for the command path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Passive interception does not alter insulin delivery; therapy manipulation is assessed in the separate safety path.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Radio traffic reveals patient treatment, dosing, and pump operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "This path is limited to reading exposed radio data and does not grant configuration or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The unauthenticated radio channel moves sensitive treatment state outside the pump boundary.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One protocol implementation can be reused to observe affected pumps across the same product family.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Proximity-bound repetition", "detail": "Each interception requires proximity to an individual patient and pump.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Eliminating the legacy protocol exposure requires the product-family mitigation or replacement program, not a session reset.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Vendor mitigation is recorded", "detail": "The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Radio traffic reveals patient treatment, dosing, and pump operational state." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0036" }, { "schema_version": "1.1", "id": "CPATH-2026-0037", "slug": "medtronic-minimed-ngp-600-series-insulin-pumps", "title": "Medtronic MiniMed / NGP 600 series insulin pumps - RF pairing protocol allows bolus/delivery manipulation", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2022-32537" ], "vendor": "Medtronic", "product": "Medtronic MiniMed / NGP 600 series insulin pumps - RF pairing protocol allows bolus/delivery manipulation", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "source": "security via NVD / NVD" } ], "cvss_headline": { "version": "v3.1", "score": 4.8, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "UNDER", "requirements_missed": [ 1 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety" ], "dominance_reason": "This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL.", "paths": [ { "id": "device-control-safety", "role": "dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:1/EX:1/PH:4/DP:0/AT:3/CH:2/SR:1/SX:1/OR:2/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be within radio range during the brief component-pairing event.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The pairing flaw creates one radio-to-command transition into insulin delivery; it does not establish a wider control-plane bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovery is per-device and procedural: end the suspect pairing, verify the pump, and apply the available mitigation guidance.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be within radio range during the brief component-pairing event.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Narrow or timing-dependent technique", "detail": "The technique requires precise timing, specialist equipment, and protocol expertise to impersonate a component during pairing.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "The path changes dosing and command state rather than extracting patient records.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "A forged paired component can issue insulin-delivery commands, but it does not obtain pump firmware or signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The pairing flaw creates one radio-to-command transition into insulin delivery; it does not establish a wider control-plane bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Target-specific technique", "detail": "The attacker must win a new pairing window for each target rather than reuse a shared credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Every attempt is one patient and one pairing event at a time within radio range.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovery is per-device and procedural: end the suspect pairing, verify the pump, and apply the available mitigation guidance.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves residual exposure", "detail": "Mitigation reduces the path, but rollout coverage or remaining exposed devices is not independently verified by this registry.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32537", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:1/EX:1/PH:4/DP:0/AT:3/CH:2/SR:1/SX:1/OR:2/EV:2/LS:PARTIALLY_MITIGATED", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Proximity or local access", "claim": "The attacker must be within radio range during the brief component-pairing event.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The pairing flaw creates one radio-to-command transition into insulin delivery; it does not establish a wider control-plane bridge.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Recovery is per-device and procedural: end the suspect pairing, verify the pump, and apply the available mitigation guidance.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Proximity or local access", "detail": "The attacker must be within radio range during the brief component-pairing event.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Narrow or timing-dependent technique", "detail": "The technique requires precise timing, specialist equipment, and protocol expertise to impersonate a component during pairing.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "No data consequence", "detail": "The path changes dosing and command state rather than extracting patient records.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "A forged paired component can issue insulin-delivery commands, but it does not obtain pump firmware or signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The pairing flaw creates one radio-to-command transition into insulin delivery; it does not establish a wider control-plane bridge.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Target-specific technique", "detail": "The attacker must win a new pairing window for each target rather than reuse a shared credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Every attempt is one patient and one pairing event at a time within radio range.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Recovery is per-device and procedural: end the suspect pairing, verify the pump, and apply the available mitigation guidance.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "Partial mitigation leaves residual exposure", "detail": "Mitigation reduces the path, but rollout coverage or remaining exposed devices is not independently verified by this registry.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Injected delivery commands can stop insulin or trigger an unintended bolus, causing severe hypoglycemia, hyperglycemia, or ketoacidosis." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0037" }, { "schema_version": "1.1", "id": "CPATH-2026-0038", "slug": "ge-carescape-apexpro-patient-monitoring-mdhex-exposed", "title": "GE CARESCAPE / ApexPro patient monitoring (MDhex) - exposed shared SSH private key", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2020-6961" ], "vendor": "GE HealthCare", "product": "GE CARESCAPE / ApexPro patient monitoring (MDhex) - exposed shared SSH private key", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "source": "NVD" } ], "cvss_headline": { "version": "v3.1", "score": 10, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "EMERGENCY", "direction": "UNDER", "requirements_missed": [ 1, 2, 7, 8 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "perception-to-action", "device-control-safety" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied.", "paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:4/EC:4/EX:4/PH:4/DP:4/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The same exposed SSH private key authenticates to reachable CARESCAPE and ApexPro monitoring systems without a per-device password.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The shared key crosses from the network into monitor administration and then into the clinical decisions driven by alarms and displays.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Recovery requires firmware that rotates the key, network isolation, and verification across every affected monitoring system.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The same exposed SSH private key authenticates to reachable CARESCAPE and ApexPro monitoring systems without a per-device password.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Using the recovered key to open an SSH session is a straightforward standard client operation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Changed alarm thresholds or patient displays can cause missed or inappropriate clinical response and create a severe safety consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "SSH grants administrator-level control of monitoring components, but not a GE firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The shared key crosses from the network into monitor administration and then into the clinical decisions driven by alarms and displays.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One exposed private key authenticates across the affected product line, making the credential directly reusable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The shared key can open sessions on many reachable monitors without obtaining a separate credential for each unit.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Recovery requires firmware that rotates the key, network isolation, and verification across every affected monitoring system.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:4/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Any attacker who can reach SSH on an affected monitor can present the exposed shared private key.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Network access crosses into monitor administration and then into the safety functions that alert clinical staff.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The fleet needs key-rotating firmware, segmentation, and confirmation that the old key no longer authenticates.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Any attacker who can reach SSH on an affected monitor can present the exposed shared private key.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A standard SSH client and the known key are sufficient to obtain interactive administrator access.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Administrator access includes alarm configuration, device state, and clinical monitoring data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The session grants administrator control of monitor configuration and alarms, but not a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Network access crosses into monitor administration and then into the safety functions that alert clinical staff.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same universal private key works across affected monitors rather than being unique to one device.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Reachable systems can be accessed at fleet scale with the same credential and no physical visit.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The fleet needs key-rotating firmware, segmentation, and confirmation that the old key no longer authenticates.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance." } }, { "id": "data-privacy", "role": "supporting", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The administrator session exposes protected health information, patient monitoring data, and sensitive device state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:4/EX:4/PH:1/DP:3/AT:2/CH:3/SR:4/SX:4/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "A reachable monitor accepts the exposed shared SSH key without a device-specific credential.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Reusable multi-stage bridge", "claim": "The shared credential crosses the network and device boundary into clinical data stored or processed by the monitor.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The administrator session exposes protected health information, patient monitoring data, and sensitive device state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The administrator session exposes protected health information, patient monitoring data, and sensitive device state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Key rotation, fixed firmware, network isolation, and review of exposed clinical data are required across the deployment.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "A reachable monitor accepts the exposed shared SSH key without a device-specific credential.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Opening the administrator session and reading stored or live data uses ordinary SSH and file-access tools.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Minor physical effect", "detail": "Reading clinical data is a privacy harm; direct alarm or display manipulation is assessed in the safety paths.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The administrator session exposes protected health information, patient monitoring data, and sensitive device state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "This path uses the session for data access; broader monitor administration is assessed separately.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Reusable multi-stage bridge", "detail": "The shared credential crosses the network and device boundary into clinical data stored or processed by the monitor.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same private key can be reused across affected devices and hospital deployments.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "One key supports remote data access to many reachable monitors without per-device credential collection.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Key rotation, fixed firmware, network isolation, and review of exposed clinical data are required across the deployment.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "cap", "reason": "The EMERGENCY base consequence is capped at CRITICAL because this path exposes protected health and monitoring data but does not independently reach the separate alarm-manipulation or safety consequence." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6961", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "perception-to-action", "role": "co-dominant", "terminal_type": "PERCEPTION_TO_ACTION", "family": "perception", "label": "Perception-to-action", "summary": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:4/EC:4/EX:4/PH:4/DP:4/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The same exposed SSH private key authenticates to reachable CARESCAPE and ApexPro monitoring systems without a per-device password.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The shared key crosses from the network into monitor administration and then into the clinical decisions driven by alarms and displays.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Safety-driving perception or intimate data", "claim": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Perception-to-action", "claim": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "Recovery requires firmware that rotates the key, network isolation, and verification across every affected monitoring system.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The same exposed SSH private key authenticates to reachable CARESCAPE and ApexPro monitoring systems without a per-device password.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Using the recovered key to open an SSH session is a straightforward standard client operation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Changed alarm thresholds or patient displays can cause missed or inappropriate clinical response and create a severe safety consequence.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Safety-driving perception or intimate data", "detail": "Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "SSH grants administrator-level control of monitoring components, but not a GE firmware-signing root.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The shared key crosses from the network into monitor administration and then into the clinical decisions driven by alarms and displays.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "One exposed private key authenticates across the affected product line, making the credential directly reusable.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The shared key can open sessions on many reachable monitors without obtaining a separate credential for each unit.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "Recovery requires firmware that rotates the key, network isolation, and verification across every affected monitoring system.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. Interactive access can falsify the patient-monitoring and alarm state that clinicians use for treatment decisions." } }, { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "band": "EMERGENCY", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:4/EX:4/PH:4/DP:3/AT:3/CH:4/SR:4/SX:4/OR:4/EV:2/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "Any attacker who can reach SSH on an affected monitor can present the exposed shared private key.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "Network access crosses into monitor administration and then into the safety functions that alert clinical staff.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Fleet action or replacement", "claim": "The fleet needs key-rotating firmware, segmentation, and confirmation that the old key no longer authenticates.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "Any attacker who can reach SSH on an affected monitor can present the exposed shared private key.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "A standard SSH client and the known key are sufficient to obtain interactive administrator access.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Reach and effort support the same exposure", "detail": "The documented reach and required effort are equally permissive, so neither reduces the other.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "Administrator access includes alarm configuration, device state, and clinical monitoring data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The session grants administrator control of monitor configuration and alarms, but not a vendor signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "Network access crosses into monitor administration and then into the safety functions that alert clinical staff.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "The same universal private key works across affected monitors rather than being unique to one device.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Reachable systems can be accessed at fleet scale with the same credential and no physical visit.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Fleet action or replacement", "detail": "The fleet needs key-rotating firmware, segmentation, and confirmation that the old key no longer authenticates.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Public report, not reproduced here", "detail": "NVD reports the condition, but this registry has not independently reproduced this path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "EMERGENCY", "adjustment": "none", "reason": "The EMERGENCY base band remains final because no separate cap or systemic uplift applies. The attacker can silence alarms or make monitors unavailable, directly undermining life-critical patient surveillance." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0038" }, { "schema_version": "1.1", "id": "CPATH-2026-0039", "slug": "baxter-sigma-spectrum-infusion-pump-wbm-unencrypted", "title": "Baxter Sigma Spectrum WBM - cleartext Wi-Fi credentials and PHI", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2022-26390" ], "vendor": "Baxter", "product": "Baxter Sigma Spectrum WBM - cleartext Wi-Fi credentials and PHI", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "source": "Baxter/Product Security via NVD / NVD" } ], "cvss_headline": { "version": "v3.1", "score": 4.2, "severity": "MEDIUM" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "HIGH", "direction": "UNDER", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "account-authority", "data-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, HIGH; no array-order tie-break is applied.", "paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:1/EC:4/EX:1/PH:2/DP:3/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "The attacker needs physical possession of an unwiped, lost, decommissioned, or resold Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A secret recovered from one discarded module can bridge into the hospital network and other reachable systems.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery may require hospital-wide credential rotation plus reliable wiping and decommissioning controls for every module.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "The attacker needs physical possession of an unwiped, lost, decommissioned, or resold Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Once the module is in hand, the cleartext wireless credential can be extracted through a straightforward local inspection.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "The credential opens a hospital network position but does not directly alter pump therapy.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The module stores hospital Wi-Fi credentials alongside protected health and operational data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A secret recovered from one discarded module can bridge into the hospital network and other reachable systems.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "A recovered network credential may be shared across a deployment and useful beyond the single module that exposed it.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One recovered credential can apply across its wireless deployment, although the initial extraction still requires one physical module.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery may require hospital-wide credential rotation plus reliable wiping and decommissioning controls for every module.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The module contains protected health information and treatment-related data at rest.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:1/EC:4/EX:1/PH:0/DP:3/AT:1/CH:2/SR:2/SX:1/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "The attacker must physically obtain an unwiped Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The exposure crosses from a discarded device into patient data, but the record itself is not an authority credential.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The module contains protected health information and treatment-related data at rest.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The module contains protected health information and treatment-related data at rest.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Mitigation combines software and process changes with verified wiping before loss, return, resale, or decommissioning.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "The attacker must physically obtain an unwiped Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Protected health information is stored in cleartext and can be read directly once the module is accessed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Reading the stored record does not itself change infusion therapy.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The module contains protected health information and treatment-related data at rest.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Read-only or preparatory access", "detail": "This path is read-only disclosure and does not grant pump configuration or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The exposure crosses from a discarded device into patient data, but the record itself is not an authority credential.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The inspection method is repeatable, while each module contains its own patient and device records.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Every disclosure requires physical access to a separate unwiped module.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Mitigation combines software and process changes with verified wiping before loss, return, resale, or decommissioning.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The module contains protected health information and treatment-related data at rest." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26390", "publisher": "NVD", "kind": "advisory" }, { "id": "rapid7-disclosure", "label": "Rapid7 disclosure", "url": "https://www.rapid7.com/blog/post/2022/09/08/baxter-sigma-spectrum-infusion-pumps-multiple-vulnerabilities-fixed/", "publisher": "Rapid7 disclosure", "kind": "other" } ], "dominant_paths": [ { "id": "account-authority", "role": "co-dominant", "terminal_type": "ACCOUNT_AUTHORITY", "family": "authority", "label": "Account authority", "summary": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:ACCOUNT_AUTHORITY/RE:1/EC:4/EX:1/PH:2/DP:3/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "The attacker needs physical possession of an unwiped, lost, decommissioned, or resold Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "A secret recovered from one discarded module can bridge into the hospital network and other reachable systems.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Bounded function authority", "claim": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Account authority", "claim": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery may require hospital-wide credential rotation plus reliable wiping and decommissioning controls for every module.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "The attacker needs physical possession of an unwiped, lost, decommissioned, or resold Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Once the module is in hand, the cleartext wireless credential can be extracted through a straightforward local inspection.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Operational safety effect", "detail": "The credential opens a hospital network position but does not directly alter pump therapy.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The module stores hospital Wi-Fi credentials alongside protected health and operational data.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "A secret recovered from one discarded module can bridge into the hospital network and other reachable systems.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Shared fleet-wide primitive", "detail": "A recovered network credential may be shared across a deployment and useful beyond the single module that exposed it.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Deployment-wide with setup", "detail": "One recovered credential can apply across its wireless deployment, although the initial extraction still requires one physical module.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery may require hospital-wide credential rotation plus reliable wiping and decommissioning controls for every module.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The recovered password grants bounded access to the hospital wireless network, not pump administration or firmware control." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The module contains protected health information and treatment-related data at rest.", "band": "HIGH", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:1/EC:4/EX:1/PH:0/DP:3/AT:1/CH:2/SR:2/SX:1/OR:2/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Per-device physical access", "claim": "The attacker must physically obtain an unwiped Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The exposure crosses from a discarded device into patient data, but the record itself is not an authority credential.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The module contains protected health information and treatment-related data at rest.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The module contains protected health information and treatment-related data at rest.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Patch, reset, or reconfiguration", "claim": "Mitigation combines software and process changes with verified wiping before loss, return, resale, or decommissioning.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Per-device physical access", "detail": "The attacker must physically obtain an unwiped Wireless Battery Module.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Straightforward operation", "detail": "Protected health information is stored in cleartext and can be read directly once the module is accessed.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Access position limits exposure", "detail": "The technique is easier to perform than it is to position against a target, so access is the constraining factor.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "Reading the stored record does not itself change infusion therapy.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The module contains protected health information and treatment-related data at rest.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Read-only or preparatory access", "detail": "This path is read-only disclosure and does not grant pump configuration or firmware authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The exposure crosses from a discarded device into patient data, but the record itself is not an authority credential.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The inspection method is repeatable, while each module contains its own patient and device records.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "One device at a time", "detail": "Every disclosure requires physical access to a separate unwiped module.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Patch, reset, or reconfiguration", "detail": "Mitigation combines software and process changes with verified wiping before loss, return, resale, or decommissioning.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "HIGH", "adjustment": "none", "reason": "The HIGH base band remains final because no separate cap or systemic uplift applies. The module contains protected health information and treatment-related data at rest." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0039" }, { "schema_version": "1.1", "id": "CPATH-2026-0040", "slug": "b-braun-infusomat-perfusor-space-spacecom2-battery", "title": "B. Braun Infusomat/Perfusor Space (SpaceCom2 / Battery pack SP with Wi-Fi) - remote unauthenticated dose alteration", "status": "published", "validation": "provisional", "path_version": "1.0-candidate", "date_scored": "2026-06-03", "date_published": "2026-06-03", "scorer": "CFSE Consequence Paths v1.0-candidate", "cve": [ "CVE-2021-33885" ], "vendor": "B. Braun", "product": "B. Braun Infusomat/Perfusor Space (SpaceCom2 / Battery pack SP with Wi-Fi) - remote unauthenticated dose alteration", "domain": "MEDICAL_IOT", "cvss": [ { "version": "v3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "source": "MITRE via NVD" }, { "version": "v3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "source": "NVD" } ], "cvss_headline": { "version": "v3.1", "score": 10, "severity": "CRITICAL" }, "unscorable_by_cvss": false, "cvss_facts_confidence": "high", "path_verdict": "CRITICAL", "direction": "SIDEWAYS", "requirements_missed": [ 1, 2, 7 ], "review": { "state": "provisional", "summary": "Candidate path derived from public sources; independent path review is open." }, "dominant_path_ids": [ "device-control-safety", "data-privacy" ], "dominance_reason": "These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied.", "paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:2/EX:2/PH:4/DP:3/AT:3/CH:4/SR:3/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The vulnerable SpaceCom2 or wireless battery-pack service is reachable without authentication from the hospital network.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The chain crosses from the hospital network into SpaceCom, pump configuration, and ultimately delivered therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patched SpaceCom and battery-pack firmware plus network hardening and verification across affected pumps.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The vulnerable SpaceCom2 or wireless battery-pack service is reachable without authentication from the hospital network.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "The demonstrated dose-alteration outcome combines five flaws and requires a specialist multi-stage chain, despite the open network entry point.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The chain reads and changes drug-library, configuration, firmware-adjacent, and operational state used for infusion.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker can write pump configuration and execute commands on SpaceCom, but does not obtain a B. Braun signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The chain crosses from the hospital network into SpaceCom, pump configuration, and ultimately delivered therapy.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The same product and firmware weaknesses are portable across affected Space systems without a universal signing secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Unauthenticated network access can reach many same-model pumps within a facility without per-device physical contact.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patched SpaceCom and battery-pack firmware plus network hardening and verification across affected pumps.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:3/EX:3/PH:0/DP:3/AT:2/CH:2/SR:2/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The same unauthenticated hospital-network position exposes the device service used by this read path.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The network service crosses into pump application data and can supply reconnaissance for the separate safety chain.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "The deployment needs the same fixed firmware and network hardening, followed by review of any state that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The same unauthenticated hospital-network position exposes the device service used by this read path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Reading configuration and operational state is a reproducible network workflow once the service is reached.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "This path is limited to confidentiality; dose manipulation and physical harm are assessed separately.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The read operation provides bounded access to device state rather than command, administrator, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The network service crosses into pump application data and can supply reconnaissance for the separate safety chain.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The same read workflow applies across affected models, but it does not depend on a shared credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The unauthenticated service can be queried across reachable same-model pumps without physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "The deployment needs the same fixed firmware and network hardening, followed by review of any state that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state." } } ], "sources": [ { "id": "nvd", "label": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33885", "publisher": "NVD", "kind": "advisory" } ], "dominant_paths": [ { "id": "device-control-safety", "role": "co-dominant", "terminal_type": "DEVICE_CONTROL_SAFETY", "family": "safety", "label": "Device-control safety", "summary": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:4/EC:2/EX:2/PH:4/DP:3/AT:3/CH:4/SR:3/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The vulnerable SpaceCom2 or wireless battery-pack service is reachable without authentication from the hospital network.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "Cross-domain authority chain", "claim": "The chain crosses from the hospital network into SpaceCom, pump configuration, and ultimately delivered therapy.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Severe therapy or actuation consequence", "claim": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Device-control safety", "claim": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "Recovery requires patched SpaceCom and battery-pack firmware plus network hardening and verification across affected pumps.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The vulnerable SpaceCom2 or wireless battery-pack service is reachable without authentication from the hospital network.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Specialist multi-step technique", "detail": "The demonstrated dose-alteration outcome combines five flaws and requires a specialist multi-stage chain, despite the open network entry point.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "Severe therapy or actuation consequence", "detail": "Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The chain reads and changes drug-library, configuration, firmware-adjacent, and operational state used for infusion.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Administrative or command authority", "detail": "The attacker can write pump configuration and execute commands on SpaceCom, but does not obtain a B. Braun signing key.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "Cross-domain authority chain", "detail": "The chain crosses from the hospital network into SpaceCom, pump configuration, and ultimately delivered therapy.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Portable product-class technique", "detail": "The same product and firmware weaknesses are portable across affected Space systems without a universal signing secret.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "Unauthenticated network access can reach many same-model pumps within a facility without per-device physical contact.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "Recovery requires patched SpaceCom and battery-pack firmware plus network hardening and verification across affected pumps.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. Silent drug-library or configuration changes can make the next infusion deliver an unexpected dose and create direct patient injury." } }, { "id": "data-privacy", "role": "co-dominant", "terminal_type": "DATA_PRIVACY", "family": "privacy", "label": "Data privacy", "summary": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "band": "CRITICAL", "vector": "CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:4/EC:3/EX:3/PH:0/DP:3/AT:2/CH:2/SR:2/SX:4/OR:3/EV:3/LS:PATCH_AVAILABLE", "steps": [ { "id": "entry-condition", "kind": "access", "label": "Network-reachable without prior access", "claim": "The same unauthenticated hospital-network position exposes the device service used by this read path.", "basis": "source", "evidence_refs": [ "nvd" ] }, { "id": "boundary-transition", "kind": "boundary", "label": "One cross-boundary bridge", "claim": "The network service crosses into pump application data and can supply reconnaissance for the separate safety chain.", "basis": "model-inference", "evidence_refs": [] }, { "id": "reachable-function", "kind": "capability", "label": "Sensitive device or personal data", "claim": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "terminal-effect", "kind": "consequence", "label": "Data privacy", "claim": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, { "id": "recovery-scope", "kind": "recovery", "label": "Coordinated operational recovery", "claim": "The deployment needs the same fixed firmware and network hardening, followed by review of any state that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] } ], "metric_explanations": { "RE": { "label": "Network-reachable without prior access", "detail": "The same unauthenticated hospital-network position exposes the device service used by this read path.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EC": { "label": "Reproducible exploit workflow", "detail": "Reading configuration and operational state is a reproducible network workflow once the service is reached.", "basis": "source", "evidence_refs": [ "nvd" ] }, "EX": { "label": "Execution effort limits exposure", "detail": "The interface is broadly reachable, but the required technique keeps practical exposure below that reach.", "basis": "model-inference", "evidence_refs": [] }, "PH": { "label": "No direct physical effect", "detail": "This path is limited to confidentiality; dose manipulation and physical harm are assessed separately.", "basis": "model-inference", "evidence_refs": [] }, "DP": { "label": "Sensitive device or personal data", "detail": "The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state.", "basis": "model-inference", "evidence_refs": [] }, "AT": { "label": "Bounded function authority", "detail": "The read operation provides bounded access to device state rather than command, administrator, or signing authority.", "basis": "model-inference", "evidence_refs": [] }, "CH": { "label": "One cross-boundary bridge", "detail": "The network service crosses into pump application data and can supply reconnaissance for the separate safety chain.", "basis": "model-inference", "evidence_refs": [] }, "SR": { "label": "Repeatable method", "detail": "The same read workflow applies across affected models, but it does not depend on a shared credential.", "basis": "operational-assumption", "evidence_refs": [] }, "SX": { "label": "Remote fleet-scale execution", "detail": "The unauthenticated service can be queried across reachable same-model pumps without physical access.", "basis": "operational-assumption", "evidence_refs": [] }, "OR": { "label": "Coordinated operational recovery", "detail": "The deployment needs the same fixed firmware and network hardening, followed by review of any state that may have been exposed.", "basis": "operational-assumption", "evidence_refs": [] }, "EV": { "label": "Reproduced or strongly report-backed", "detail": "NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.", "basis": "source", "evidence_refs": [ "nvd" ] }, "LS": { "label": "A patch is available", "detail": "A vendor fix is available, while deployment and upgrade completion remain separate operational questions.", "basis": "source", "evidence_refs": [ "nvd" ] } }, "decision": { "base_band": "CRITICAL", "adjustment": "none", "reason": "The CRITICAL base band remains final because no separate cap or systemic uplift applies. The exposed material includes pump configuration, drug-library, firmware-adjacent, and sensitive operational state." } } ], "url": "https://paths.cfse.ai/CPATH-2026-0040" } ]