CVE-2024-48971 - Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator

Back Back to CVE browser

CRITICAL

Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator

Published Nov 14, 2024

9.3

CRITICAL

CVSS 3.1

EPSS 0.22%

Description

The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges.

Affected products

Vendor Baxter Product Life2000 Ventilation System Default
unaffected
Affected
- 06.08.00.00 and prior

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Baxter	Life2000 Ventilation System	unaffected	Affected 06.08.00.00 and prior

Vendor Baxter Product Life2000 Ventilator Firmware Default
unaffected
Affected
- ≥ 0, ≤ 06.08.00.00

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Baxter	Life2000 Ventilator Firmware	unaffected	Affected ≥ 0, ≤ 06.08.00.00

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-43156		Advisory
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Baxter

Published Nov 14, 2024

Updated Nov 15, 2024

Reserved Oct 10, 2024

Link CVE-2024-48971

CISA Vulnrichment

Updated Nov 15, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2024-48971

Red Hat

No data

ENISA EUVD

Assigner Baxter

Published Nov 14, 2024

Updated Nov 15, 2024

Link EUVD-2024-43156

GitHub

No data