Missing Protection against Hardware Reverse Engineering Using Integrated Circuit Imaging…
Priority LOW 28CWE-1278Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted.
Why it matters now
EPSS 0.00234 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Boston Scientific | ZOOM LATITUDE | Model 3120 | — | No fix listed | CNA |
- ZOOM LATITUDE VendorBoston Scientific Affected Model 3120 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Boston Scientific |
| cpe:2.3:h:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Boston Scientific |
- cpe:2.3:o:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Boston Scientific
- cpe:2.3:h:bostonscientific:zoom_latitude_pogrammer\/recorder\/monitor_3120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Boston Scientific
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38394
- 2026-10-03 Alias added: GHSA-c3hf-72hw-fvr7
References
More Boston Scientific Zoom Latitude Pogrammer/recorder/monitor 3120 Firmware vulnerabilities
- TI-2021-15996 Improper Access Control for Boston Scientific Zoom Latitude CVSS 3.1HIGH 7.6
- TI-2021-16002 Reliance on Component that is not Updateable for Boston Scientific Zoom Latitude CVSS 3.1MEDIUM 6.8
- TI-2021-16004 Use of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom Latitude CVSS 3.1MEDIUM 6.9
- TI-2021-16000 Missing Support Integrity Check for Boston Scientific Zoom Latitude CVSS 3.1MEDIUM 6.8
Sources
- CVE-2021-38394 · CVE Program
- CVE-2021-38394 · NVD
- FIRST EPSS
- GHSA-c3hf-72hw-fvr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences