CVE-2024-48974

Estado: AplazadaCrítica (9.3)—

The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 9.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.15%
Percentil entre todas las CVEs puntuadas: 4
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1195 Supply Chain Compromiseinitial access85 %
Impacto principalT1565.001 Stored Data Manipulationimpact80 %
Impacto secundarioT1005 Data from Local Systemcollection70 %
Impacto secundarioT1499.004 Application or System Exploitationimpact75 %

Manipulación de firmware sin verificación de integridad (CWE-494). Ataque de cadena de suministro (T1195) que permite modificar configuración, comprometer funcionalidad, causar DoS y divulgar información.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Application Developer Guidance Vulnerability Scanning User Account Management Restrict File and Directory Permissions Remote Data Storage Limit Software Installation

CWE

CWE-494

Referencias

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-48974",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-48974",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-18T15:31:47.610421Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "productsecurity@baxter.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "productsecurity@baxter.com",
      "affectedData": [
        {
          "vendor": "Baxter",
          "product": "Life2000 Ventilation System",
          "versions": [
            {
              "status": "affected",
              "version": "06.08.00.00 and prior"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:baxter:life2000_ventilator_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "baxter",
          "product": "life2000_ventilator_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "06.08.00.00"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-14T22:15:18.727",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01",
      "source": "productsecurity@baxter.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productsecurity@baxter.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-494"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure."
    },
    {
      "lang": "es",
      "value": "El respirador no realiza comprobaciones adecuadas de la integridad de los archivos al adoptar actualizaciones de firmware. Esto hace posible que un atacante fuerce cambios no autorizados en la configuración del dispositivo o comprometa la funcionalidad del dispositivo al introducir un archivo de firmware comprometido o ilegítimo. Esto podría interrumpir el funcionamiento del dispositivo o provocar la divulgación no autorizada de información."
    }
  ],
  "lastModified": "2026-06-17T07:59:08.733",
  "sourceIdentifier": "productsecurity@baxter.com"
}