What’s Vulnerable › Vulnerabilities
CVE-2024-48967: Life2000 ventilator and Service PC lack sufficient audit logging capabilities
- Severity: critical (CVSS 10.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-14 · updated 2026-06-17
- Weakness: CWE-778
Description
The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance.
Affected products
- Baxter Life2000 Ventilator Firmware: before 6.08.00.00 — fixed in 6.08.00.00
How to fix
Upgrade to a fixed version: Baxter Life2000 Ventilator Firmware 6.08.00.00. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-48967 or the next vulnerability affects your stack