CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48971 – Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator
https://notcve.org/view.php?id=CVE-2024-48971
The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9832 – No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator
https://notcve.org/view.php?id=CVE-2024-9832
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9834 – Improper data protection on Life2000 ventilator serial interface
https://notcve.org/view.php?id=CVE-2024-9834
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5176 – Vulnerability in Welch Allyn Configuration Tool Software
https://notcve.org/view.php?id=CVE-2024-5176
Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior. La vulnerabilidad de credenciales insuficientemente protegidas en la herramienta de configuración Baxter Welch Allyn puede permitir servicios remotos con credenciales robadas. Este problema afecta a la herramienta de configuración Welch Allyn: versiones 1.9.4.1 y anteriores. • https://cisa.gov/news-events/ics-medical-advisories/icsma-24-151-01 • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1275 – Vulnerability in Baxter Welch Allyn Connex Spot Monitor
https://notcve.org/view.php?id=CVE-2024-1275
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52. El uso de la vulnerabilidad de clave criptográfica predeterminada en Baxter Welch Ally Connex Spot Monitor puede permitir la manipulación de la configuración/entorno. Este problema afecta a Welch Ally Connex Spot Monitor en todas las versiones anteriores a la 1.52. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-151-02 • CWE-1394: Use of Default Cryptographic Key •