by Kastro
Paper/Archive/CVE-2024-48971

CVE-2024-48971

Baxter Life2000 Ventilation System — Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
30
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 12.2.122 × 202.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges.

Affected

ProductAffectedFixed inSource
Life2000 Ventilation System06.08.00.00 and prior–CNA
life2000_ventilator_firmware≤ 06.08.00.00–CISA-ADP

Scores by source

Baxter (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-medical-advisories/icsma-24-319-01