CVE-2021-37162

published 2021-08-02

CVE-2021-37162: A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software…

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. If an attacker sends a malformed UDP message, a buffer underflow occurs, leading to an out-of-bounds copy and possible remote code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
swisslog-healthcare	hmi-3_control_panel_firmware	< 7.2.5.7	7.2.5.7

Detection & IOCs extracted from sources · hover to see the quote

port UDP/12345

bytes

TLPU (start of UDP payload)

bytes

|00 00 00 01| at offset 8 within UDP payload

snort

alert udp any any -> $HOME_NET 12345 (msg:"ET EXPLOIT [PwnedPiper] Exploitation Attempt - Small Malformed Translogic Packet (Multiple CVEs)"; dsize:<21; content:"TLPU"; startswith; fast_pattern; content:"|00 00 00 01|"; distance:4; within:4; reference:url,www.armis.com/pwnedPiper; reference:cve,2021-37162; reference:cve,2021-37165; reference:cve,2021-37161; classtype:attempted-admin; sid:2033661; rev:1; metadata:attack_target Server, created_at 2021_08_03, cve CVE_2021_37162, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2021_08_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

• → Trigger on small (< 21 byte) malformed UDP packets destined for port 12345 that begin with the magic bytes 'TLPU' — this is the Translogic/Nexus Panel control protocol identifier used in PwnedPiper exploitation.
• → The exploit involves sending a malformed UDP message that causes a buffer underflow, leading to an out-of-bounds copy; monitor for anomalously short UDP datagrams to port 12345 on HMI/Nexus Panel hosts. ↗
• → The byte sequence |00 00 00 01| appearing 4 bytes after the 'TLPU' magic is a distinguishing characteristic of the malformed exploit packet.

• · The Snort/Suricata rule targets $HOME_NET broadly; scope it to only hosts running Swisslog Healthcare Nexus Panel (HMI3 Control Panel) to reduce false positives.
• · This rule covers multiple CVEs in the PwnedPiper family (CVE-2021-37162, CVE-2021-37165, CVE-2021-37161); a match does not uniquely confirm CVE-2021-37162 in isolation.
• · Vulnerable only on Nexus Panel software versions prior to 7.2.5.7; ensure asset inventory is used to confirm exposure before acting on alerts. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-120