Cleartext transmission of sensitive information in Life2000 Ventilation System - CVE-2024-9834
Published: November 18, 2024
Vulnerability identifier: #VU100582
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-9834
CWE-ID: CWE-319
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to gain access to sensitive information.
The vulnerability exists due to improper data protection on the ventilator's serial interface. A local attacker can send and receive specially crafted messages to gain access to sensitive information, leading to unintended impact on device settings and performance.
Affected software
Life2000 Ventilation System
How to mitigate CVE-2024-9834
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.