Critical severity · published Nov 14, 2024
CVE-2024-48966
Life2000 service tools for test and calibration do not support user authentication
10.0
CVSS
0.7%
EPSS
No
On KEV
Description
The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LV
Life2000 Ventilation System · Baxter
06.08.00.00 and prior · source: vendor
LV
Life2000 Ventilator Firmware · Baxter
before 6.08.00.00 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-48966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-48966
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
More from Life2000 Ventilation System
10.0
CVE-2024-48967
Life2000 ventilator and Service PC lack sufficient audit logging capabilities
9.3
CVE-2024-48970
Life2000 Ventilator microcontroller lacks memory protection
9.3
CVE-2024-48974
Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates
9.3
CVE-2024-48973
Debug port on Life2000 Ventilator serial interface is enabled by default
9.3
CVE-2024-48971
Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator