CVE-2021-43935

CRITICAL 9.8CVE-2021-43935 · Published 15/12/2021 · updated 17/06/2026

In short

CVE-2021-43935 is a CRITICAL (CVSS 9.8) vulnerability affecting welch allyn connex cardio (baxter), welch allyn diagnostic cardiology suite (baxter), welch allyn rscribe resting ecg system (baxter).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
welch allyn connex cardio baxter	`≥ 1.0.0, ≤ 1.1.1`	No fix yet
welch allyn diagnostic cardiology suite baxter	`= 2.1.0`	No fix yet
welch allyn rscribe resting ecg system baxter	`≥ 5.01, ≤ 7.0.0`	No fix yet
welch allyn vision express holter analysis system baxter	`≥ 6.1.0, ≤ 6.4.0`	No fix yet

Description

The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.

References

cisa.gov/uscert/ics/advisories/icsma-21-343-01 · Mitigation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free