CVE-2024-48973
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.22%
- CWE
- CWE-1263
- Published
- 2024-11-14
- Last modified
- 2026-03-13
Affected products
- Baxter Life2000 Ventilation System
Weakness type
Related vulnerabilities
- CVE-2026-80253 — An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an...
- CVE-2025-4386 — Medtronic MyCareLink Patient Monitor Hardware Debug Port
- CVE-2025-6785 — Tesla Model 3 Physical CAN Bus Injection
- CVE-2025-8762 — INSTAR 2K+/4K UART improper physical access control
- CVE-2024-39512 — Junos OS Evolved: User is not logged out when the console cable is disconnected
- CVE-2022-48183
- CVE-2022-48182
- CVE-2022-3728