CVE-2021-38392
Improper Access Control for Boston Scientific Zoom Latitude
A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Improper Access Control for Boston Scientific Zoom Latitude
A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.
- Record
CVE-2021-38392- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2021-24844
A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.
- Record
EUVD-2021-24844- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3xgp-qw97-rfg4
A skilled attacker with physical access to the affected device can gain access to the hard disk...
A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.
- Record
GHSA-3xgp-qw97-rfg4- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.
- Record
CVE-2021-38392- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38392 is a medium vulnerability (CVSS 6.5) in Boston Scientific Zoom Latitude, published October 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.