CVE-2025-3321 - Vulnerability Details - OpenCVE

A predefined administrative account is not documented and cannot
be deactivated. This account cannot be misused from the network, only by local
users on the server.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00027.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2025-17093	A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server.

Fixes

Solution

Field Service Information FSI 14-25 “OnlineSuite AP3.0 - Security Fix” provides a patch to these issues.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.bbraun.com/productsecurity

History

Fri, 06 Jun 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 06 Jun 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server.
Title		Use of Hard-coded Credentials in OnlineSuite
Weaknesses		CWE-798
References		https://www.bbraun.com/productsecurity
Metrics		cvssV4_0 `{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: B.Braun

Published: 2025-06-06T08:12:46.971Z

Updated: 2025-06-06T18:25:54.094Z

Reserved: 2025-04-05T19:01:47.895Z

Link: CVE-2025-3321

Vulnrichment

Updated: 2025-06-06T18:25:48.466Z

NVD

Status : Awaiting Analysis

Published: 2025-06-06T08:15:21.183

Modified: 2025-06-06T14:07:28.330

Link: CVE-2025-3321

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3321", "assignerOrgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "state": "PUBLISHED", "assignerShortName": "B.Braun", "dateReserved": "2025-04-05T19:01:47.895Z", "datePublished": "2025-06-06T08:12:46.971Z", "dateUpdated": "2025-06-06T18:25:54.094Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OnlineSuite", "vendor": "B. Braun Melsungen AG", "versions": [{"status": "affected", "version": "3.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Fabian Weber (CODE WHITE GmbH)"}, {"lang": "en", "type": "reporter", "value": "Dr. Florian Hauser (CODE WHITE GmbH)"}], "datePublic": "2025-06-06T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>A predefined administrative account is not documented and cannot\nbe deactivated. This account cannot be misused from the network, only by local\nusers on the server.</p>\n\n\n\n\n\n<p></p>"}], "value": "A predefined administrative account is not documented and cannot\nbe deactivated. This account cannot be misused from the network, only by local\nusers on the server."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "shortName": "B.Braun", "dateUpdated": "2025-06-06T08:12:46.971Z"}, "references": [{"url": "https://www.bbraun.com/productsecurity"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues."}], "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues."}], "source": {"discovery": "UNKNOWN"}, "title": "Use of Hard-coded Credentials in OnlineSuite", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-06T17:42:18.841236Z", "id": "CVE-2025-3321", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T18:25:54.094Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3321", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-06T17:42:18.841236Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T18:25:48.466Z"}}], "cna": {"title": "Use of Hard-coded Credentials in OnlineSuite", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Fabian Weber (CODE WHITE GmbH)"}, {"lang": "en", "type": "reporter", "value": "Dr. Florian Hauser (CODE WHITE GmbH)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "B. Braun Melsungen AG", "product": "OnlineSuite", "versions": [{"status": "affected", "version": "3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues.", "supportingMedia": [{"type": "text/html", "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues.", "base64": false}]}], "datePublic": "2025-06-06T07:00:00.000Z", "references": [{"url": "https://www.bbraun.com/productsecurity"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A predefined administrative account is not documented and cannot\nbe deactivated. This account cannot be misused from the network, only by local\nusers on the server.", "supportingMedia": [{"type": "text/html", "value": "<p></p><p>A predefined administrative account is not documented and cannot\nbe deactivated. This account cannot be misused from the network, only by local\nusers on the server.</p>\n\n\n\n\n\n<p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "shortName": "B.Braun", "dateUpdated": "2025-06-06T08:12:46.971Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3321", "state": "PUBLISHED", "dateUpdated": "2025-06-06T18:25:54.094Z", "dateReserved": "2025-04-05T19:01:47.895Z", "assignerOrgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "datePublished": "2025-06-06T08:12:46.971Z", "assignerShortName": "B.Braun"}, "dataVersion": "5.1"}