#VU100605 Download of code without integrity check in Life2000 Ventilation System - CVE-2024-48974
Vulnerability identifier: #VU100605
Vulnerability risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-494
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Life2000 Ventilation System
Hardware solutions /
Other hardware appliances
Vendor: Baxter
Description
The vulnerability allows a local attacker to compromise the affected system
The vulnerability exists due to the ventilator does not perform proper file integrity checks when adopting firmware updates. A local attacker can changes to the device's configuration settings and/or compromise device functionality after a successful software update.
Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versions
Life2000 Ventilation System: 06.08.00.00
External links
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
https://www.baxter.com/sites/g/files/ebysai3896/files/2024-11/ICSMA-24-319-01-Baxter-Life-2000-Ventilation-System.pdf
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
