What’s Vulnerable › Vulnerabilities
CVE-2024-48966: Life2000 service tools for test and calibration do not support user authentication
- Severity: critical (CVSS 10.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-14 · updated 2026-06-17
- Weakness: CWE-306
Description
The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
Affected products
- Baxter Life2000 Ventilator Firmware: before 6.08.00.00 — fixed in 6.08.00.00
How to fix
Upgrade to a fixed version: Baxter Life2000 Ventilator Firmware 6.08.00.00. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-48966 or the next vulnerability affects your stack