CVSS: 5.0EPSS: 0%CPEs: -EXPL: 1CVE-2024-46383
https://notcve.org/view.php?id=CVE-2024-46383
15 Nov 2024 — Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext. • https://github.com/nitinronge91/Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-13227
https://notcve.org/view.php?id=CVE-2017-13227
14 Nov 2024 — This could lead to information disclosure with no additional execution privileges needed. • https://source.android.com/security/bulletin/2018-06-01 •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48967 – Life2000 ventilator and Service PC lack sufficient audit logging capabilities
https://notcve.org/view.php?id=CVE-2024-48967
14 Nov 2024 — An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-778: Insufficient Logging •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48966 – Life2000 service tools for test and calibration do not support user authentication
https://notcve.org/view.php?id=CVE-2024-48966
14 Nov 2024 — An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48970 – Life2000 Ventilator microcontroller lacks memory protection
https://notcve.org/view.php?id=CVE-2024-48970
14 Nov 2024 — An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-1191: On-Chip Debug and Test Interface With Improper Access Control •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48974 – Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates
https://notcve.org/view.php?id=CVE-2024-48974
14 Nov 2024 — This could disrupt the function of the device and/or cause unauthorized information disclosure. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-494: Download of Code Without Integrity Check •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48973 – Debug port on Life2000 Ventilator serial interface is enabled by default
https://notcve.org/view.php?id=CVE-2024-48973
14 Nov 2024 — This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-1263: Improper Physical Access Control •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9832 – No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator
https://notcve.org/view.php?id=CVE-2024-9832
14 Nov 2024 — An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9834 – Improper data protection on Life2000 ventilator serial interface
https://notcve.org/view.php?id=CVE-2024-9834
14 Nov 2024 — Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-49025 – Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-49025
14 Nov 2024 — Microsoft Edge (Chromium-based) Information Disclosure Vulnerability • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49025 • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •