CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48971 – Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator
https://notcve.org/view.php?id=CVE-2024-48971
The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9832 – No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator
https://notcve.org/view.php?id=CVE-2024-9832
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9834 – Improper data protection on Life2000 ventilator serial interface
https://notcve.org/view.php?id=CVE-2024-9834
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-319: Cleartext Transmission of Sensitive Information •