PT-2024-33308 · Unknown · Ventilator

Published 2024-11-14 · Updated 2024-11-15 · CVE-2024-48974

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ventilator (affected versions not specified)

Description The issue concerns the ventilator's failure to perform proper file integrity checks when adopting firmware updates. This allows an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised or illegitimate firmware file. As a result, the function of the device could be disrupted, and/or unauthorized information disclosure could occur.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2024-48974

Affected Products

Ventilator

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-48974 · Security Note
• https://twitter.com/CVEnew/status/1857190651655487839 · Twitter Post
• https://cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 · Note
• https://t.me/cvedetector/11020 · Telegram Post