Skip to content
Fencer Vulns
critical 9.8

CVE-2021-27410 json

The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn m…

published 2021-06-11 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-14164

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).

Patch / fix

  • hillrom connex_central_station 1.8.6
  • hillrom connex_device_integration_suite_network_connectivity_engine 5.3
  • hillrom connex_integrated_wall_system 2.43.02
  • hillrom connex_spot_monitor 1.52
  • hillrom connex_vital_signs_monitor 2.43.02
  • hillrom service_monitor 1.7.0.0
  • hillrom service_tool 1.10
  • hillrom software_development_kit 3.2
  • hillrom spot_vital_signs_4400 1.11.00

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-21-152-01 updated cvss 5.9

Hillrom Medical Device Management (Update B)

  • Hillrom Welch Allyn Connex Central Station (CS) < 1.8.4 Service Pack 01 Hillrom Welch Allyn Connex Device Integration Suite - Network Connectivity Engine (NCE) < 5.3 Hillrom Welch Allyn Connex Integrated Wall System (CIWS) < 2.43.02 Hillrom Welch Allyn Connex Spot Monitor (CSM) < 1.52 Hillrom Welch Allyn Connex Vital Signs Monitor (CVSM) < 2.43.02 Hillrom Welch Allyn Service Monitor < 1.7.0.0
    +3 more products
    Hillrom Welch Allyn Service Tool < 1.10 Hillrom Welch Allyn Software Development Kit (SDK) < 3.2 Hillrom Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device < 1.11.00
    affected: vendor fix, mitigation “Apply proper network and physical security controls.” hillrom.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • n/a Welch Allyn medical device management tools

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.