LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Two maximum-severity flaws in a ventilation system

MedDevice Cyber Staff · Nov 14 · 3 min read · Via CISA

Baxter Life2000 Ventilation System, version 06.08.00.00 and prior, drew ICSMA-24-319-01. Nine CVEs, two of them, CVE-2024-48966 and CVE-2024-48967, at a maximum base score of 10.0.

The list reads like a catalog of what not to do on a life-support device: hard-coded credentials, cleartext transmission, unrestricted authentication attempts, an exposed JTAG debug interface, missing authentication, missing logging. Together they allow unauthorized access, information disclosure and device disruption. A ventilator is as safety-critical as medical devices get, and a maximum-severity missing-authentication finding on one is the scenario the premarket cybersecurity regime exists to prevent.

An exposed JTAG interface on a shipped product is a debug door left in the wall. Close the debug interfaces, authenticate every function, encrypt every link. On a device that breathes for a patient there is no acceptable shortcut.

Remediation Desk

The Baxter Life2000 Ventilation System carried nine CVEs (ICSMA-24-319-01), two rated a maximum 10.0, spanning hard-coded credentials, cleartext transmission, an exposed JTAG interface and missing authentication. Apply the vendor remediation and, on ventilators, treat hardware debug interfaces and embedded secrets as safety issues.

Apply the vendor remediation. Follow ICSMA-24-319-01 to the fixed configuration across the fleet.
Disable the debug interface. A production device should have JTAG or equivalent debug access disabled or locked, not exposed.
Remove embedded secrets and encrypt traffic. Replace hard-coded credentials with provisioned secrets and put all communication over encrypted transport.
Authenticate control paths. Every command that changes ventilation behavior must require authentication.

Sources

CISA ↗

Questions & Answers

What was found in the Baxter Life2000 Ventilation System?

ICSMA-24-319-01 lists nine CVEs in versions 06.08.00.00 and prior, including CVE-2024-48966 and CVE-2024-48967 at a maximum base score of 10.0, spanning hard-coded credentials, cleartext transmission, an exposed JTAG interface and missing authentication.

How serious are the Life2000 findings?

Two of the nine flaws carry a 10.0, the highest score CVSS gives. On a ventilator, missing authentication and hard-coded credentials allow unauthorized access, information disclosure and device disruption.

Why does an exposed JTAG interface matter on a shipped device?

JTAG is a hardware debug door. Left enabled on a production ventilator, it gives an attacker with physical access a path into the device that no software control blocks. Debug interfaces belong closed before shipment.

← Back to Vulnerabilities