Improper Physical Access Control in Life2000 Ventilation System - CVE-2024-48973
Published: November 18, 2024
Vulnerability identifier: #VU100594
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-48973
CWE-ID: CWE-1263
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Baxter
Affected software:
Life2000 Ventilation System
Life2000 Ventilation System
Detailed vulnerability description
The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the debug port on the ventilator's serial interface is enabled by default. A local attacker can send and receive specially crafted messages over the debug port to gain access to sensitive information, leading to unintended impact on device settings and performance.
How to mitigate CVE-2024-48973
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.