CVE-2024-48973

CRITICAL

Improper Physical Access Control (CWE-1263)

2024-11-14 productsecurity@baxter.com

Authentication Bypass

9.3

CVSS 3.1 · Vendor: baxter

Severity by source

Vendor (baxter) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (baxter) · only source for this CVE.

CVSS VectorVendor: baxter

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 14, 2024 - 22:15 cve.org

CRITICAL 9.3

DescriptionCVE.org

The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.

AnalysisAI

The debug port on the ventilator's serial interface is enabled by default. Rated critical severity (CVSS 9.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1263. The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.