Vulnerability · Published Nov 14, 2024 · Assigned by Baxter
CVE-2024-48970Life2000 Ventilator microcontroller lacks memory protection
Critical 9.3
In plain English
A critical-severity security flaw in Life2000 Ventilation System from Baxter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.2%top 88.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Baxter | Life2000 Ventilation System | 06.08.00.00 and prior |
Weakness: CWE-1191 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H