CVE-2024-9834 (GCVE-0-2024-9834)

Vulnerability from cvelistv5 – Published: 2024-11-14 20:57 – Updated: 2024-11-15 15:10
VLAI?
Title
Improper data protection on Life2000 ventilator serial interface
Summary
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
Severity ?
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-319 - Cleartext Transmission of Sensitive Information
Assigner
References
Impacted products
Vendor Product Version
Baxter Life2000 Ventilation System Affected: 06.08.00.00 and prior
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:baxter:life2000_ventilator_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "life2000_ventilator_firmware",
            "vendor": "baxter",
            "versions": [
              {
                "lessThanOrEqual": "06.08.00.00",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9834",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T15:09:40.431805Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T15:10:40.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Life2000 Ventilation System",
          "vendor": "Baxter",
          "versions": [
            {
              "status": "affected",
              "version": "06.08.00.00 and prior"
            }
          ]
        }
      ],
      "datePublic": "2024-11-14T20:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper data protection on the ventilator\u0027s serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.\u003cbr\u003e"
            }
          ],
          "value": "Improper data protection on the ventilator\u0027s serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-117",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-117 Interception"
            }
          ]
        },
        {
          "capecId": "CAPEC-441",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-441 Malicious Logic Insertion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-14T21:47:25.133Z",
        "orgId": "dba971b9-eb30-4121-91e1-3b45611354aa",
        "shortName": "Baxter"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper data protection on Life2000 ventilator serial interface",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dba971b9-eb30-4121-91e1-3b45611354aa",
    "assignerShortName": "Baxter",
    "cveId": "CVE-2024-9834",
    "datePublished": "2024-11-14T20:57:22.734Z",
    "dateReserved": "2024-10-10T19:24:48.834Z",
    "dateUpdated": "2024-11-15T15:10:40.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Improper data protection on the ventilator\u0027s serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.\"}, {\"lang\": \"es\", \"value\": \"La protecci\\u00f3n de datos inadecuada en la interfaz serial del ventilador podr\\u00eda permitir que un atacante env\\u00ede y reciba mensajes que resulten en una divulgaci\\u00f3n no autorizada de informaci\\u00f3n y/o tengan impactos no deseados en la configuraci\\u00f3n y el rendimiento del dispositivo.\"}]",
      "id": "CVE-2024-9834",
      "lastModified": "2024-11-15T13:58:08.913",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"productsecurity@baxter.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.5, \"impactScore\": 6.0}]}",
      "published": "2024-11-14T21:15:22.803",
      "references": "[{\"url\": \"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01\", \"source\": \"productsecurity@baxter.com\"}]",
      "sourceIdentifier": "productsecurity@baxter.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"productsecurity@baxter.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-319\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-9834\",\"sourceIdentifier\":\"productsecurity@baxter.com\",\"published\":\"2024-11-14T21:15:22.803\",\"lastModified\":\"2024-11-15T13:58:08.913\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper data protection on the ventilator\u0027s serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.\"},{\"lang\":\"es\",\"value\":\"La protecci\u00f3n de datos inadecuada en la interfaz serial del ventilador podr\u00eda permitir que un atacante env\u00ede y reciba mensajes que resulten en una divulgaci\u00f3n no autorizada de informaci\u00f3n y/o tengan impactos no deseados en la configuraci\u00f3n y el rendimiento del dispositivo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"productsecurity@baxter.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"productsecurity@baxter.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]}],\"references\":[{\"url\":\"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01\",\"source\":\"productsecurity@baxter.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-9834\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-15T15:09:40.431805Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:baxter:life2000_ventilator_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"baxter\", \"product\": \"life2000_ventilator_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"06.08.00.00\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-15T15:10:35.306Z\"}}], \"cna\": {\"title\": \"Improper data protection on Life2000 ventilator serial interface\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-117\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-117 Interception\"}]}, {\"capecId\": \"CAPEC-441\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-441 Malicious Logic Insertion\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Baxter\", \"product\": \"Life2000 Ventilation System\", \"versions\": [{\"status\": \"affected\", \"version\": \"06.08.00.00 and prior\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-11-14T20:43:00.000Z\", \"references\": [{\"url\": \"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper data protection on the ventilator\u0027s serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper data protection on the ventilator\u0027s serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-319\", \"description\": \"CWE-319 Cleartext Transmission of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"dba971b9-eb30-4121-91e1-3b45611354aa\", \"shortName\": \"Baxter\", \"dateUpdated\": \"2024-11-14T21:47:25.133Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-9834\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-15T15:10:40.157Z\", \"dateReserved\": \"2024-10-10T19:24:48.834Z\", \"assignerOrgId\": \"dba971b9-eb30-4121-91e1-3b45611354aa\", \"datePublished\": \"2024-11-14T20:57:22.734Z\", \"assignerShortName\": \"Baxter\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.