What’s Vulnerable › Vulnerabilities

CVE-2021-27408

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-11 · updated 2026-06-17
• Weakness: CWE-125

Description

The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).

Affected products

• Hillrom Connex Central Station: before 1.8.6 — fixed in 1.8.6
• Hillrom Connex Device Integration Suite Network Connectivity Engine: before 5.3 — fixed in 5.3
• Hillrom Connex Integrated Wall System: before 2.43.02 — fixed in 2.43.02
• Hillrom Connex Spot Monitor: before 1.52 — fixed in 1.52
• Hillrom Connex Vital Signs Monitor: before 2.43.02 — fixed in 2.43.02
• Hillrom Service Monitor: before 1.7.0.0 — fixed in 1.7.0.0
• Hillrom Service Tool: before 1.10 — fixed in 1.10
• Hillrom Software Development Kit: before 3.2 — fixed in 3.2
• Hillrom Spot Vital Signs 4400: before 1.11.00 — fixed in 1.11.00

How to fix

Upgrade to a fixed version: Hillrom Connex Central Station 1.8.6; Hillrom Connex Device Integration Suite Network Connectivity Engine 5.3; Hillrom Connex Integrated Wall System 2.43.02; Hillrom Connex Spot Monitor 1.52; Hillrom Connex Vital Signs Monitor 2.43.02; Hillrom Service Monitor 1.7.0.0; Hillrom Service Tool 1.10; Hillrom Software Development Kit 3.2; Hillrom Spot Vital Signs 4400 1.11.00. Check the vendor advisory for mitigations.

References

• https://us-cert.cisa.gov/ics/advisories/icsma-21-152-01
• https://us-cert.cisa.gov/ics/advisories/icsma-21-152-01

Get alerted when CVE-2021-27408 or the next vulnerability affects your stack