CVE-2024-48973

Nov. 15, 2024, 1:58 p.m.

9.3
Critical

Description

The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.

Product(s) Impacted

Product Versions
UNKNOWN
  • []

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1263
Improper Physical Access Control
The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01

Tags

productsecurity@baxter.com
2024-11-14
CVE-2024-48973
CWE-1263

CVSS Score

9.3 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

    View Vector String

Timeline

Published: Nov. 14, 2024, 10:15 p.m.
Last Modified: Nov. 15, 2024, 1:58 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

productsecurity@baxter.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.