PT-2024-33303 · Unknown · Ventilator+1

Published 2024-11-14 · Updated 2024-11-15 · CVE-2024-48967

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ventilator and Service PC (affected versions not specified)

Description The ventilator and the Service PC lack sufficient audit logging capabilities, making it difficult to detect malicious activity and conduct forensic examinations. An attacker with access to these systems could make unauthorized changes to ventilator settings without detection, potentially leading to unauthorized disclosure of information and unintended impacts on device performance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-778

Related Identifiers

CVE-2024-48967

Affected Products

Service Pc

Ventilator

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-48967 · Security Note
• https://cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 · Note
• https://twitter.com/VulmonFeeds/status/1857228101878513745 · Twitter Post
• https://t.me/cvedetector/11022 · Telegram Post
• https://twitter.com/CVEnew/status/1857190644990755105 · Twitter Post