- 7.6HighCVSS base score
- 0.47%Exploitation in 30 daysEPSS · top 59% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.
Timeline
ID reserved
By icscert
- 20 months later
· 20 months later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | High7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L |
| NVDNVD · Modified | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
- EPSS (exploitation in 30 days)
- 0.47% · top 59% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.
Affected products
B. Braun Melsungen AG · SpaceCom
- affected unspecified – ≤ U61
- affected unspecified – ≤ L81
B. Braun Melsungen AG · Battery pack with Wi-Fi
- affected unspecified – ≤ U61
- affected unspecified – ≤ L81
B. Braun Melsungen AG · Data module compactplus
- affected A10
- affected A11
What to do
Solution: B. Braun recommends applying updates: SpaceCom: Version U62 or later (United States), L82 or later (outside the United States) Battery Pack SP with Wi-Fi: Version U62 or later (United States), L82 or later (outside the United States) Data module compactplus: Version A12 or later Please contact your local B. Braun organization to request further help. For more information please see the B. Braun Security Advisory. https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
Workaround: As a general security measure, B. Braun recommends protecting the network with appropriate mechanisms: Ensure the devices are not accessible directly from the Internet. Use a firewall and isolate the medical devices from the business network. Please contact your local B. Braun organization to request further help. For more information please see the B. Braun Security Advisory. https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html
References
References2
- https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2020-17857 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2020-25166)Record last updated .