CVE-2025-3321 - CVE House
Back to Database
Status published Critical CVE-2025-3321

Use of Hard-coded Credentials in OnlineSuite

Vulnerability Description

A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3321

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Fabian Weber (CODE WHITE GmbH)
  • Dr. Florian Hauser (CODE WHITE GmbH)

References

More from B. Braun Melsungen AG

View All →
CVE-2025-3365
Relative Path Traversal in OnlineSuite
Critical 9.8
CVE-2025-3322
Improper Neutralization of Special Elements in OnlineSuite
Critical 10
CVE-2020-25174
B. Braun OnlineSuite
High 7.8
CVE-2020-25172
B. Braun OnlineSuite
Critical 9.8
CVE-2020-25170
B. Braun OnlineSuite
High 7.8

Affected Vendor

B. Braun Melsungen AG

View all reports →

Affected Software

OnlineSuite
Vulnerable Versions:
3.0

Timeline

Official Publish: June 6th, 2025
Last Modified: June 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation