CVE-2023-0888: B. Braun Battery Pack SP with Wi-Fi Code-Injection Flaw Grants Root Access to an Infusion-Pump Communication Module

CVE-2023-0888 is a code-injection vulnerability in the embedded web server of B. Braun's Battery Pack SP with Wi-Fi, the Wi-Fi communication module attached to B. Braun's Space series infusion pumps: an authenticated attacker who already holds the module's web-server credentials and has network access to the device can inject code to gain administrative (root) access to the communication module, from which they could escalate privileges, view sensitive information, upload arbitrary files, or pursue remote code execution, and NVD has published its own Primary CVSS v3.1 score of 7.2 (high) for the flaw.

CVE-2023-0888 (improper neutralization of directives in dynamically evaluated code) affects B. Braun's Battery Pack SP with Wi-Fi, the Wi-Fi communication module that pairs with B. Braun's Space series infusion pumps. NVD's description states: "An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network ... and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module" (NVD).

NVD lists the CVE's status as "Modified" with its own Primary CVSS v3.1 base score of 7.2 (high), classifying the weakness as code injection (CWE-94) — a higher-severity reading than the eval-injection (CWE-95) classification B. Braun submitted as the Secondary source. NVD's record of B. Braun's own Secondary CVSS submission lists 4.9, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N (NVD).

B. Braun's own security advisory, published the same week, states the issue carries "a CVSS v3 base score of 5.5 ... the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L)" — a third, slightly different figure from the two NVD records, though all three agree the attack requires an authenticated user who already holds the module's web-server credentials and Wi-Fi network access (B. Braun security advisory 3/2023).

B. Braun's advisory explains the practical impact: "Successful exploitation of these vulnerabilities could allow a sophisticated and authenticated attacker to compromise the security of the Space communication device 'Battery Pack SP with Wi-Fi' allowing an attacker to escalate privileges, view sensitive information, upload arbitrary files, and perform remote code execution," while also noting "the infusion pumps are not directly affected, however the interrupted network communication might prevent certain features of the device from functioning properly" such as receiving infusion orders from EMR/PDMS systems or drug-library updates (B. Braun security advisory 3/2023).

CISA's advisory ICSMA-23-103-01, published the same week, places the Battery Pack SP with Wi-Fi in the Healthcare and Public Health sector with worldwide deployment and a Germany-headquartered vendor, and credits cybersecurity consultant Tom Johnston with reporting the flaw (CISA ICS Medical Advisory ICSMA-23-103-01).

The affected products are Battery Pack SP with Wi-Fi units with serial number 138853 and higher running software 053L000091/054U000091 (global/U.S.) or 053L000092/054U000092 (global/U.S.). B. Braun's fix is software 053L000093/054U000093; CISA additionally recommends minimizing network exposure, isolating control systems behind firewalls, and using VPNs for necessary remote access (CISA ICS Medical Advisory ICSMA-23-103-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.006 (49.1st percentile) as of 2026-11-07 — a flaw NVD itself rates high-severity but that requires an attacker to already hold device credentials and network access before exploitation can begin (CISA KEV, FIRST EPSS).

Any facility running a B. Braun Battery Pack SP with Wi-Fi below software 053L000093/054U000093 should apply B. Braun's update, change the module's default Wi-Fi credentials, and keep infusion-pump communication modules on a segmented network separate from general hospital IT, per B. Braun's and CISA's guidance.

• An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server can be used to gain administrative (root) access to the infusion pump communication module. — NVD
• NVD status 'Modified'; NVD Primary CVSS v3.1 base score 7.2, weakness classified as code injection (CWE-94); NVD's record of B. Braun's Secondary submission is 4.9, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. — NVD
• B. Braun's own advisory lists CVSS v3 base score 5.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L; successful exploitation could let an attacker escalate privileges, view sensitive information, upload arbitrary files, and perform remote code execution; infusion pumps are not directly affected but may lose EMR/PDMS order or drug-library updates. — B. Braun security advisory 3/2023
• Affects Healthcare and Public Health sector, worldwide deployment, Germany-headquartered vendor; reported by Tom Johnston; remediation is software 053L000093/054U000093 plus network segmentation and VPN for remote access. — CISA ICS Medical Advisory ICSMA-23-103-01
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00604 (49.1st percentile) as of 2026-11-07. — FIRST EPSS