CVE-2021-37160

—

CVSS 3.1

9.8 critical

EPSS

8%p95

Published

Aug 2, 2021 (Aug 2, 2021)

Modified

Jun 17, 2026

Description

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.

Vendors: swisslog-healthcare
Products: hmi-3 control panel firmware
Weakness: CWE-347
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (8.2%)

In the news4 stories

PwnedPiper PTS Security Flaws Threaten 80% of Hospitals in the U.S.

The Hacker NewsAug 12, 13:04 UTC · Aug 12, 2021Ransomware CVE-2021-37161 CVE-2021-37162 CVE-2021-37163+5 CVEs

PwnedPiper flaws in PTS systems affect 80% of major US hospitals

Security AffairsAug 2, 19:47 UTC · Aug 2, 2021Ransomware CVE-2021-37161 CVE-2021-37162 CVE-2021-37163+5 CVEs

Critical vulnerabilities may allow attackers to compromise hospitals' pneumatic tube system

Help Net SecurityAug 2, 00:00 UTC · Aug 2, 2021Vulnerability in the wildCVE-2021-37160

PwnedPiper vulnerabilities impact 80% of major hospitals in North America

The RecordJan 4, 00:00 UTC · Jan 4, 2023Vulnerability CVE-2021-37163 CVE-2021-37167 CVE-2021-37161+5 CVEs