CVE-2021-27408: Hillrom Connex Central Station

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).

Affected products

• Hillrom Connex Central Station: before 1.8.6 (fixed in 1.8.6)
• Hillrom Connex Device Integration Suite Network Connectivity Engine: before 5.3 (fixed in 5.3)
• Hillrom Connex Integrated Wall System: before 2.43.02 (fixed in 2.43.02)
• Hillrom Connex Spot Monitor: before 1.52 (fixed in 1.52)
• Hillrom Connex Vital Signs Monitor: before 2.43.02 (fixed in 2.43.02)
• Hillrom Service Monitor: before 1.7.0.0 (fixed in 1.7.0.0)
• Hillrom Service Tool: before 1.10 (fixed in 1.10)
• Hillrom Software Development Kit: before 3.2 (fixed in 3.2)
• Hillrom Spot Vital Signs 4400: before 1.11.00 (fixed in 1.11.00)

Published 2021-06-11. Last modified 2026-06-17.