CVE-2021-38400
CVE-2021-38400 is a medium-severity vulnerability in Bostonscientific Zoom Latitude Pogrammer/recorder/monitor 3120 Firmware with a CVSS 3.x base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-916.
Key facts
- Severity: Medium (CVSS 3.x base score 6.9)
- CVSS v2: 4.6
- EPSS exploit prediction: 0% (4th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-916
- Affected product: Bostonscientific Zoom Latitude Pogrammer/recorder/monitor 3120 Firmware
- Published:
- Last modified:
Description
An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password.
Frequently asked questions
- What is CVE-2021-38400?
- An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password.
- How severe is CVE-2021-38400?
- CVE-2021-38400 has a CVSS 3.x base score of 6.9, rated medium severity. It is exploitable over physical access with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability low.
- Is CVE-2021-38400 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-38400?
- CVE-2021-38400 affects Bostonscientific Zoom Latitude Pogrammer/recorder/monitor 3120 Firmware. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-38400?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2021-38400 published?
- CVE-2021-38400 was published on 2021-10-04 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:o:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Bostonscientific Zoom Latitude Pogrammer/recorder/monitor 3120 Firmware
- CVE-2021-38398 — Medium (CVSS 6.5): The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker…
- CVE-2021-38396 — Medium (CVSS 6.5): The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software…
- CVE-2021-38392 — Medium (CVSS 6.5): A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to…
- CVE-2021-38394 — Medium (CVSS 6.2): An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse…
All CVEs affecting Bostonscientific Zoom Latitude Pogrammer/recorder/monitor 3120 Firmware →
Other CWE-916 vulnerabilities
- CVE-2020-14516 — Critical (CVSS 10.0): In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the…
- CVE-2026-30789 — Critical (CVSS 9.8): Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts…
- CVE-2024-5743 — Critical (CVSS 9.8): An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome…
- CVE-2021-36767 — Critical (CVSS 9.8): In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the…
- CVE-2021-32519 — Critical (CVSS 9.8): Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows…
- CVE-2019-17216 — Critical (CVSS 9.8): An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password…