{"id":"CVE-2026-97358","kind":"vulnerability","aliases":["CVE-2026-97358"],"related":[],"title":"B. Braun SpaceCom: inclusion of web functionality from an untrusted source allows remote code execution","description":"An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom","summary":"B. Braun Melsungen (CNA, productsecurity@bbraun.com) reports that SpaceCom, the network communication module of the Space infusion pump system, includes web functionality from an untrusted source (CWE-94), which could allow remote code execution. VulDB lists the affected versions as up to U/L94 (secondary source). B. Braun's own bulletin for this CVE was not found, so the fix, trigger and exact version range are unconfirmed. No exploitation or public PoC is reported.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SpaceCom","fixed":[],"affected":"<= U/L94 (per VulDB, unconfirmed)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["b-braun","infusion-pump","medical-device","other","rce","spacecom"],"not_affected_if":[],"how_to_check":"Look up the SpaceCom software version in the device web interface or asset inventory. VulDB lists U/L94 and earlier as affected; this is unconfirmed by B. Braun. Check B. Braun's product security page (bbraun.com/en/products-and-solutions/b--braun-product-security) for a bulletin on this CVE.","fix":null,"status":"open","published_at":"2026-11-13T18:17:50+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","triaged_at":"2026-11-13T18:51:34+00:00","updated_at":"2026-11-13T18:53:52+00:00","category":"other","confidence":0.45,"triage":{"at":"2026-11-13T18:51:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SpaceCom: untrusted web content inclusion allows remote code execution","impact":"high","summary":"SpaceCom includes web functionality from an untrusted source, which an attacker can abuse to run code. The sources give no further detail on the affected component or the trigger.","audience":"businesses","category":"other","nicknames":[],"who_cares":["spacecom"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the affected SpaceCom system","analyst_note":"Find the vendor or project behind SpaceCom and its advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-97358 to confirm the affected versions, fix and trigger.","how_to_check":"unknown","plain_action":"","product_name":"SpaceCom","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":4479,"output_tokens":387,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor or project behind SpaceCom and its advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-97358 to confirm the affected versions, fix and trigger.","search":"'-2026':17A,20A '-94':61B '-97358':18A,21A 'affect':71B 'allow':12A,64B,117C 'b':1A,24B,35B,79B 'b-braun':23B 'braun':2A,25B,36B,80B 'bulletin':83B 'cna':38B 'code':14A,66B,119C 'communic':45B 'could':63B,116C 'cve':16A,19A,86B 'cwe':60B 'devic':31B 'exact':95B 'execut':15A,67B,120C 'exploit':101B 'fix':92B 'found':89B 'function':7A,55B,111C 'includ':53B 'inclus':4A,108C 'infus':27B,50B 'infusion-pump':26B 'list':69B 'medic':30B 'medical-devic':29B 'melsungen':37B 'modul':46B 'network':44B 'poc':104B 'productsecurity@bbraun.com':39B 'public':103B 'pump':28B,51B 'rang':97B 'rce':33B 'remot':13A,65B,118C 'report':40B,106B 'secondari':77B 'sourc':11A,59B,78B,115C 'space':49B 'spacecom':3A,22A,34B,42B,122C 'system':52B 'trigger':93B 'u/l94':76B 'unconfirm':99B 'untrust':10A,58B,114C 'version':72B,96B 'vuldb':68B 'web':6A,54B,110C","nicknames":[],"mitigations":[],"who_affected":"Hospitals and clinics that run B. Braun Space infusion systems with a SpaceCom communication module (VulDB lists versions up to U/L94). Per B. Braun's earlier Space advisories, the communication devices are separate from the pumps; this CVE's own bulletin was not found, so whether pumps are affected is unconfirmed. Teams that do not run SpaceCom can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["spacecom"],"ptokens":["spacecom"],"labels":["bbraun","high","infusionpump","medicaldevice","other","rce","spacecom","vendor"],"campaign_type":null,"search_a":"'-2026':17A,20A '-97358':18A,21A 'allow':12A 'b':1A 'braun':2A 'code':14A 'cve':16A,19A 'execut':15A 'function':7A 'inclus':4A 'remot':13A 'sourc':11A 'spacecom':3A,22A 'untrust':10A 'web':6A","search_b":"'-94':61B 'affect':71B 'allow':64B 'b':24B,35B,79B 'b-braun':23B 'braun':25B,36B,80B 'bulletin':83B 'cna':38B 'code':66B 'communic':45B 'could':63B 'cve':86B 'cwe':60B 'devic':31B 'exact':95B 'execut':67B 'exploit':101B 'fix':92B 'found':89B 'function':55B 'includ':53B 'infus':27B,50B 'infusion-pump':26B 'list':69B 'medic':30B 'medical-devic':29B 'melsungen':37B 'modul':46B 'network':44B 'poc':104B 'productsecurity@bbraun.com':39B 'public':103B 'pump':28B,51B 'rang':97B 'rce':33B 'remot':65B 'report':40B,106B 'secondari':77B 'sourc':59B,78B 'space':49B 'spacecom':34B,42B 'system':52B 'trigger':93B 'u/l94':76B 'unconfirm':99B 'untrust':58B 'version':72B,96B 'vuldb':68B 'web':54B","search_c":"'allow':117C 'code':119C 'could':116C 'execut':120C 'function':111C 'inclus':108C 'remot':118C 'sourc':115C 'spacecom':122C 'untrust':114C 'web':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@bbraun.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97358","severity":null,"published_at":"2026-11-13T18:17:50+00:00","modified_at":"2026-11-13T18:17:50+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","fetched_at":"2026-11-13T18:49:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97358:3921","url":"https://vuldb.com/vuln/437250","severity":null,"published_at":"2026-11-13T18:53:52+00:00","modified_at":"2026-11-13T18:53:52+00:00","first_seen_at":"2026-11-13T18:53:52+00:00","fetched_at":"2026-11-13T18:53:52+00:00","note":"NVD page empty; no B. Braun bulletin or CISA advisory found for this CVE yet. Vendor identified as B. Braun via CVSS source and VulDB VDB-437250 (secondary, up to U/L94, CWE-94, remote). Sibling CVE-2026-97357 is the same product. Fix and trigger unknown; nothing verified. Revisit when B. Braun or CISA publishes.","cites":["https://vuldb.com/vuln/437250"]}],"documents":[{"id":148664,"url":"https://vuldb.com/vuln/437250","title":"VulDB VDB-437250: B. Braun Melsungen SpaceCom up to U/L94 code injection","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}