Medium severity6.2NVD Advisory· Published Oct 4, 2021· Updated Jun 17, 2026

CVE-2021-38394

Description

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Boston Scientific/ZOOM LATITUDE PRMcpe-rescue
Range: Model 3120

Patches

Vulnerability mechanics

References

us-cert.cisa.gov/ics/advisories/icsma-21-273-01nvdThird Party AdvisoryUS Government Resource

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.2/ 10

Attack vector: Physical
Complexity: High
Privileges: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: High
Availability: Low

Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

EPSS

Probability of exploitation in the next 30 days.

0.22%

VYPR risk score

Composite of severity, exploitation, and reach.

0.40medium

cvss	0.403
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

No CWEs mapped.

CVE ID

CVE-2021-38394

Credits

EP
Endres Puschner - Max Planck Institute for Security and Privacy, Bochum, Christoph Saatjohann - FH Münster University of Applied Sciences, Christian Dresen - FH Münster University of Applied Sciences, and Markus Willing - University of Muenster, discovered these issues as part of broader academic research of cardiac devices and reported them to Boston Scientific.
finder