Critical severity · published Nov 14, 2024
CVE-2024-48974
Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates
9.3
CVSS
0.2%
EPSS
No
On KEV
Description
The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LV
Life2000 Ventilation System · Baxter
06.08.00.00 and prior · source: vendor
LV
Life2000 Ventilator Firmware · Baxter
through 06.08.00.00 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-48974
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-48974
www.cisa.gov
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
More from Life2000 Ventilation System
10.0
CVE-2024-48967
Life2000 ventilator and Service PC lack sufficient audit logging capabilities
10.0
CVE-2024-48966
Life2000 service tools for test and calibration do not support user authentication
9.3
CVE-2024-48970
Life2000 Ventilator microcontroller lacks memory protection
9.3
CVE-2024-48973
Debug port on Life2000 Ventilator serial interface is enabled by default
9.3
CVE-2024-48971
Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator