PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-48973 Baxter CVE debrief

A critical vulnerability in the Baxter Life2000 Ventilation System exposes an enabled-by-default debug port on the device's serial interface. The debug port accepts unencrypted messages, allowing an attacker with physical access to send and receive commands that could disclose sensitive information or alter device settings and performance. The vulnerability carries a CVSS 3.1 score of 9.3 (Critical), reflecting severe confidentiality, integrity, and availability impacts with low attack complexity and no required privileges. Baxter has not released a patch as of the November 14, 2024 advisory publication; a follow-up announcement is planned for Q2 2025. No exploitation has been reported.

Vendor
Baxter
Product
Life2000 Ventilation System
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-14
Original CVE updated
2024-11-14
Advisory published
2024-11-14
Advisory updated
2024-11-14

Who should care

Healthcare delivery organizations, clinical engineering departments, biomedical equipment technicians, respiratory therapy departments, hospital security teams, and medical device security programs responsible for ventilator fleet management and patient safety.

Technical summary

The Baxter Life2000 Ventilation System (versions <=06.08.00.00) ships with an enabled debug port on its serial interface. The debug port processes unencrypted messages, permitting an attacker with physical access to read device data and issue commands that modify settings or impair performance. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) yields a 9.3 Critical score. No patch is available; mitigation relies on physical access controls until Baxter's planned Q2 2025 update.

Defensive priority

critical

Recommended defensive actions

  • Restrict physical access to Life2000 Ventilation System devices; do not leave ventilators unattended in public or unsecured areas per vendor guidance.
  • Monitor for anomalous serial interface activity or unauthorized device connections.
  • Await Baxter's Q2 2025 follow-up announcement for patch availability and apply updates when released.
  • Review CISA ICS recommended practices for medical device security and defense-in-depth strategies.
  • Coordinate with clinical engineering and biomedical teams to inventory affected devices and enforce physical security controls.

Evidence notes

The vulnerability description and remediation guidance are drawn from CISA ICS Medical Advisory ICSMA-24-319-01, published November 14, 2024. The affected product version is Life2000 Ventilation System <=06.08.00.00. CVSS vector confirms local attack vector with no user interaction required and scope change, resulting in 9.3 Critical score.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-48973 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-48973

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-48973 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-48973

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsma-24-319-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.