CVE-2021-37167

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus...

9.8 Critical

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. A user logged in using the default credentials can gain root access to the device, which provides permissions for all of the functionality of the device.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.74%Up 0.7 points since Aug 3, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-37167
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-269
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-37167
Updated: 2026-11-02

EUVDEUVD-2021-23741 No score

Record: EUVD-2021-23741
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8qqq-cpgj-vw4r 9.8

An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus...

Record: GHSA-8qqq-cpgj-vw4r
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-276
Updated: 2026-11-02

Affected products

swisslog-healthcare hmi-3 control panel firmware

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-37167 is a critical vulnerability (CVSS 9.8) in Swisslog-healthcare Hmi-3 Control Panel Firmware, published August 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. No source names a fixed version.