by Kastro
Paper/Archive/CVE-2024-48973

CVE-2024-48973

Baxter Life2000 Ventilation System — Debug port on Life2000 Ventilator serial interface is enabled by default

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
30
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 12.6.126 × 202.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.

Affected

ProductAffectedFixed inSource
Life2000 Ventilation System06.08.00.00 and prior–CNA
life2000_ventilator_firmware≤ 06.08.00.00–CISA-ADP

Scores by source

Baxter (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-medical-advisories/icsma-24-319-01