CVE-2024-48967 Baxter CVE debrief

Who should care

Healthcare organizations, medical device administrators, and cybersecurity teams responsible for medical devices should be aware of this vulnerability and take necessary precautions.

Technical summary

The ventilator and the Service PC of the Baxter Life2000 Ventilation System lack sufficient audit logging capabilities. This omission enables an attacker with access to the ventilator and/or the Service PC to make unauthorized changes to ventilator settings without detection. Such actions could result in unauthorized disclosure of information and/or have unintended impacts on device performance. The CVSS score for this vulnerability is 10, indicating a critical severity level.

Defensive priority

Immediate attention is required to address this critical vulnerability. Organizations using the Baxter Life2000 Ventilation System should implement compensating controls and monitor for suspicious activity.

Recommended defensive actions

• Review and enhance audit logging for the Life2000 Ventilation System and Service PC.
• Implement strict access controls to limit who can make changes to ventilator settings.
• Monitor for suspicious activity and implement anomaly detection mechanisms.
• Ensure physical security of the ventilators to prevent unauthorized access.
• Stay informed about updates from Baxter regarding this vulnerability.

Evidence notes

The CISA CSAF advisory provides details about the vulnerability, including its description and potential impacts. Baxter plans to issue a follow-up announcement in Q2 2025 regarding the Life2000 vulnerabilities. Users are advised to maintain physical possession and control of the ventilator to reduce the likelihood of a malicious actor gaining access.

Official resources