CVE-2024-48973
Debug port on Life2000 Ventilator serial interface is enabled by default
- State
- Published
- Severity
- 9.3 Critical
- Published
- Nov 14, 2024
- Updated
- Nov 18, 2024
- Reserved
- Oct 10, 2024
Description
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.3 Critical | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | Baxter |
Weaknesses
- CWE-1263 Improper Physical Access Control
Affected Products
| Product | Versions |
|---|---|
Life2000 Ventilation SystemBaxter |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.