Vulnerability · Published Nov 14, 2024 · Assigned by Baxter
CVE-2024-48971Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator
Critical 9.3
In plain English
A critical-severity hard-coded credentials in Life2000 Ventilation System from Baxter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.2%top 87.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Baxter | Life2000 Ventilation System | 06.08.00.00 and prior |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H