CVE-2021-37163

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus...

9.8 Critical

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software 7.2.5.7. The device has two user accounts with passwords that are hardcoded.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.44%Up 0.4 points since Aug 3, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-37163
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-798
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-37163
Updated: 2026-11-02

EUVDEUVD-2021-23737 No score

Record: EUVD-2021-23737
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4f84-vrx5-rhj8 No score

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus...

Record: GHSA-4f84-vrx5-rhj8
Weakness: CWE-798
Updated: 2026-11-02

Affected products

swisslog-healthcare hmi-3 control panel firmware

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-37163 is a critical vulnerability (CVSS 9.8) in Swisslog-healthcare Hmi-3 Control Panel Firmware, published August 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. No source names a fixed version.