Critical severity · published Nov 14, 2024
CVE-2024-48973
Debug port on Life2000 Ventilator serial interface is enabled by default
9.3
CVSS
0.2%
EPSS
No
On KEV
Description
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LV
Life2000 Ventilation System · Baxter
06.08.00.00 and prior · source: vendor
LV
Life2000 Ventilator Firmware · Baxter
through 06.08.00.00 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-48973
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-48973
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
More from Life2000 Ventilation System
10.0
CVE-2024-48967
Life2000 ventilator and Service PC lack sufficient audit logging capabilities
10.0
CVE-2024-48966
Life2000 service tools for test and calibration do not support user authentication
9.3
CVE-2024-48970
Life2000 Ventilator microcontroller lacks memory protection
9.3
CVE-2024-48974
Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates
9.3
CVE-2024-48971
Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator