#VU100594 Improper Physical Access Control in Life2000 Ventilation System - CVE-2024-48973
Published: November 18, 2024
Vulnerability identifier: #VU100594
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-48973
CWE-ID: CWE-1263
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Life2000 Ventilation System
Life2000 Ventilation System
Software vendor:
Baxter
Baxter
Description
The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the debug port on the ventilator's serial interface is enabled by default. A local attacker can send and receive specially crafted messages over the debug port to gain access to sensitive information, leading to unintended impact on device settings and performance.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.