#VU100582 Cleartext transmission of sensitive information in Life2000 Ventilation System - CVE-2024-9834
Published: November 18, 2024
Vulnerability identifier: #VU100582
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-9834
CWE-ID: CWE-319
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Life2000 Ventilation System
Life2000 Ventilation System
Software vendor:
Baxter
Baxter
Description
The vulnerability allows a local attacker to gain access to sensitive information.
The vulnerability exists due to improper data protection on the ventilator's serial interface. A local attacker can send and receive specially crafted messages to gain access to sensitive information, leading to unintended impact on device settings and performance.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.