CVE-2021-37160

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus...

9.8 Critical

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

8.23%Up 7.2 points since Aug 3, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-37160
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-347
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-37160
Updated: 2026-11-02

EUVDEUVD-2021-23734 No score

Record: EUVD-2021-23734
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3vvw-g7qx-ffjj 9.8

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus...

Record: GHSA-3vvw-g7qx-ffjj
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

Affected products

swisslog-healthcare hmi-3 control panel firmware

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-37160 is a critical vulnerability (CVSS 9.8) in Swisslog-healthcare Hmi-3 Control Panel Firmware, published August 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.23%, the 94th percentile. No source names a fixed version.