B. Braun manufactures a portfolio of infusion pumps, administration systems, and clinical networked devices spanning products such as Infusomat, SpaceCom, and DataModule platforms, which are deployed in hospital environments where reliability and security directly impact patient safety. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and recur across this medical-device portfolio through weakness classes including improper cryptographic signature verification, path traversal, open redirects, active debug code, and cleartext transmission of sensitive data—patterns consistent with legacy embedded medical software and networked clinical infrastructure. The exposure in medical devices reflects particular risk given the difficulty of patching deployed systems in healthcare settings and the potential for these flaws to compromise drug-delivery precision and clinical-workflow integrity. Defenders managing B. Braun infrastructure should prioritize network segmentation, inventory affected device models and firmware versions, and coordinate with their biomedical teams on patch availability and deployment constraints; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bbraun over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-33885CRITICAL An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data | Aug 25, 2021 | 9.8 | 30 | NO | NO |
CVE-2020-25172CRITICAL A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. | Nov 6, 2020 | 9.8 | 29 | NO | NO |
CVE-2020-25150HIGH A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with servi | Apr 14, 2022 | 8.8 | 28 | NO | NO |
CVE-2020-25152HIGH A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 al | Apr 14, 2022 | 8.1 | 26 | NO | NO |
CVE-2021-33884CRITICAL An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the | Aug 25, 2021 | 9.1 | 26 | NO | NO |
CVE-2020-25162HIGH A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remot | Apr 14, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-33886HIGH An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing | Aug 25, 2021 | 8.8 | 25 | NO | NO |
CVE-2021-33882HIGH A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source bec | Aug 25, 2021 | 8.6 | 25 | NO | NO |
CVE-2020-25164HIGH A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to recover user credentials | Apr 14, 2022 | 7.5 | 24 | NO | NO |
CVE-2020-25156HIGH Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptogr | Apr 14, 2022 | 7.2 | 24 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bbraun.
Media articles that mention a CVE ID that affects a product developed by Bbraun — matched by CVE ID, not by vendor name.