PT-2024-39873 · Unknown · Ventilator

Published 2024-11-14 · Updated 2024-11-15 · CVE-2024-9832

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ventilator (affected versions not specified)

Description The issue allows for an unlimited number of failed login attempts with the Clinician Password or the Serial Number Clinician Password. This enables an attacker to perform a brute-force attack, potentially gaining unauthorized access to the ventilator. Once accessed, an attacker could modify device settings, disrupting the device's function and/or leading to unauthorized information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-9832

Affected Products

Ventilator

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-9832 · Security Note
• https://twitter.com/VulmonFeeds/status/1857246021035647191 · Twitter Post
• https://twitter.com/CVEnew/status/1857190654897758306 · Twitter Post
• https://cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 · Note
• https://t.me/cvedetector/11009 · Telegram Post