Medium severity6.5NVD Advisory· Published Oct 4, 2021· Updated Jun 17, 2026

CVE-2021-38396

Description

The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cisagov/ICSMA-21-273-01llm-create
Boston Scientific/ZOOM LATITUDE PRMcpe-rescue
Range: Model 3120

Patches

Vulnerability mechanics

References

us-cert.cisa.gov/ics/advisories/icsma-21-273-01nvdThird Party AdvisoryUS Government Resource

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.5/ 10

Attack vector: Physical
Complexity: Low
Privileges: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: High
Availability: Low

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

EPSS

Probability of exploitation in the next 30 days.

0.16%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

No CWEs mapped.

CVE ID

CVE-2021-38396

Credits

EP
Endres Puschner - Max Planck Institute for Security and Privacy, Bochum, Christoph Saatjohann - FH Münster University of Applied Sciences, Christian Dresen - FH Münster University of Applied Sciences, and Markus Willing - University of Muenster, discovered these issues as part of broader academic research of cardiac devices and reported them to Boston Scientific.
finder