Page 8 of 10838 results (0.159 seconds)

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-778: Insufficient Logging •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-306: Missing Authentication for Critical Function •

CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0

An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-1191: On-Chip Debug and Test Interface With Improper Access Control •

CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0

This could disrupt the function of the device and/or cause unauthorized information disclosure. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-494: Download of Code Without Integrity Check •

CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0

This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. • https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 • CWE-1263: Improper Physical Access Control •