Hard-coded clinician credentials

1. Summary

The clinician authentication mechanism of the Baxter Life2000 Ventilation System stores its Clinician Password and Serial Number Clinician Password hard-coded into the ventilator in plaintext form [1][2]. Because these secrets are static and identical across the fleet, anyone who recovers them — from a target device, an identical unit, or firmware — can authenticate with clinician privileges. With clinician access, an attacker can change therapy and device settings on a life-support ventilator and access information the device holds [2]. The defect is classified as CWE-798 (Use of Hard-Coded Credentials) [1]. The vulnerability was ultimately not patched: after a planned Q2 2025 follow-up, Baxter permanently removed the Life2000 from the market via a cybersecurity recall rather than shipping fixed firmware [9][10].

2. Affected products & versions

3. The vulnerability in detail

The flaw lives in the clinician authentication tier of the Life2000 ventilator’s firmware — the gate that controls who is allowed to change the device’s therapy and configuration settings [1]. On the Life2000, clinical settings changes are protected behind two credentials: a Clinician Password and a Serial Number Clinician Password (a clinician password derived from the device’s serial number). The defect is that both of these credentials are hard-coded into the ventilator in plaintext form [1][2]. This is the entire vulnerability class in a sentence, and it maps directly onto CWE-798, Use of Hard-Coded Credentials.

The root cause is that these are static, non-rotatable secrets baked into the product rather than per-device secrets an operator can set. Because the passwords are fixed in the device/firmware and stored without hashing or encryption, two consequences follow that make this far worse than a single-device password leak. First, they are the same across units — this is a fleet-wide shared secret, not a per-patient or per-hospital credential. Second, they cannot be changed by the operator without a firmware or product update, so even an operator who suspects compromise has no self-service remediation path [1]. CWE-798 describes exactly this failure: the software contains authentication material that is fixed in the code or device image, so knowledge of that material — obtainable by anyone with access to any copy of the product — is sufficient to authenticate, and the material cannot be rotated the way a normal user-set password can. The two credentials fail in slightly different ways worth separating. The Clinician Password is a single embedded literal, so recovering it once yields a master key to every ventilator’s clinician tier. The Serial Number Clinician Password is nominally per-device because it is a function of the device serial number, but because the derivation is a fixed algorithm compiled into every unit’s firmware, recovering that algorithm from any one device (or the firmware image) collapses “per-device” back into “fleet-wide”: an attacker who reads a target’s serial number — printed on the device or read over its interface — can compute that device’s clinician password directly. Neither credential is a secret the operator provisions, and neither can be revoked.

Because the passwords are stored in plaintext rather than as a salted hash, there is no offline-cracking step and no work factor protecting them. The mechanism of exploitation is therefore simply credential recovery followed by replay. An attacker who has access to any copy of the secret material can read it and then present it to a target device as legitimate credentials. Critically, the recovery step does not need to touch the victim ventilator: the plaintext password (or the serial-derivation algorithm) can be extracted off any Life2000, an identical unit, or the firmware image [2]. This decoupling of recovery from the target is the property that turns a local-access weakness into a fleet-wide one — the “hard” part of the attack happens once, on an attacker-controlled unit, and the result generalizes to every device in the field. The same advisory documents several companion weaknesses that make that one-time extraction cheap: the ventilator’s serial/debug port is enabled by default, firmware can be downloaded without an integrity check, and internal JTAG memory access and a read-out-protection bypass are available (CVE-2024-48973, CVE-2024-48974, CVE-2024-48970, CVE-2020-8004) [2] — collectively, ample avenue to read stored secrets off an attacker-owned device.

Once recovered, the attacker replays the credential against the target device’s normal clinician-login path to unlock clinician-level access, then uses the device’s ordinary clinician settings workflow — no exploit primitive, memory corruption, or firmware modification required — to change configuration [2]. The advisory frames the impact of unauthorized clinician access as the ability to make changes to device settings that could disrupt the function of the device and/or cause unauthorized information disclosure [2].

The preconditions are captured by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H [1]. Exploitation requires local access (AV:L) to the target device and has low attack complexity (AC:L). It requires no prior privileges (PR:N) — the hard-coded credential is the privilege — and no user interaction (UI:N). The gating factor is therefore physical or serial proximity to the target Life2000, plus prior recovery of the shared secret. Importantly, the Life2000 is a portable ventilator intended for home use, which makes untrusted physical access a realistic scenario rather than an in-hospital-only edge case [2].

Step by step, the exploitation chain is:

1. Obtain a Life2000, an identical unit, or its firmware/serial interface and recover the hard-coded plaintext Clinician Password and/or the serial-number derivation algorithm for the Serial Number Clinician Password. Because the credential is static and shared fleet-wide, this step need not touch the victim device [2].
2. Gain local access to the target Life2000 (physical/serial proximity; AV:L), and if using the serial-derived password, read the target’s serial number [1][2].
3. Authenticate to the target using the recovered (or computed) hard-coded clinician credential to obtain clinician-level privileges [2].
4. Use the device’s normal clinician settings workflow to alter ventilation/therapy or device settings, disrupting device function and/or extracting information [2].

The impact is amplified by two further companion weaknesses disclosed in the same advisory: the Life2000 has no failed-login limit (CVE-2024-9832) and insufficient logging (CVE-2024-48967, CVSS 10.0), so credential replay is neither rate-limited nor reliably recorded, and the malicious activity may go undetected [2].

The concrete secret material needed to actually run this — the plaintext password values and the serial-number-to-password derivation algorithm — is not published, so the barrier to a working attack today is recovering those values, not any novel technique.

4. Discovery & timeline

Baxter self-reported the vulnerability set to CISA; the company is both discoverer-of-record and the CNA/assigner for the CVE [2]. No individual external researcher is credited in the available sources. Disclosure was via CISA ICS-Medical advisory ICSMA-24-319-01 and the NVD record for CVE-2024-48971, both published November 14, 2024 [1][2]. CVE-2024-48971 is one of nine vulnerabilities disclosed together in that advisory [2]. As of that publication, Baxter stated it planned a follow-up announcement in Q2 2025 regarding the Life2000 vulnerabilities [2]. That follow-up materialized as a permanent product removal / cybersecurity recall: Baxter’s urgent medical-device customer letter FA-2025-010 is dated April 10, 2025, and healthcare-sector recall alerts followed in late 2025 [9][10]. Baxter reported no serious injuries or deaths associated with the issue as of April 10, 2025 [10]. Earlier internal discovery or vendor-disclosure dates prior to 2024-11-14 are not documented in the available sources.

5. Technical reference

• CVE: CVE-2024-48971 [1][3]
• CWE: CWE-798 (Use of Hard-Coded Credentials) [1]
• CVSS v3.1 (NVD / Baxter as CNA): 9.3 CRITICAL — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H [1]. Metric read for this bug: AV:L — the attacker needs local/serial access to the target, the primary gate on the vector. AC:L — no special conditions once the credential is held. PR:N — the hard-coded credential substitutes for any privilege the device would otherwise require. UI:N — no operator action needed. S:C — authenticating to the clinician component lets the attacker affect a resource beyond that component (the therapy the device delivers). C:H/I:H/A:H — high confidentiality, integrity, and availability impact on the device.
• CVSS v4 (CISA): 9.4 — CVSS4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H [2].
• Code/commit refs: None — this is closed medical-device firmware; no public code or commit references exist.
• Related CVEs in ICSMA-24-319-01: cleartext serial transmission (CVE-2024-9834), no failed-login limit (CVE-2024-9832), enabled default debug port (CVE-2024-48973), firmware download without integrity check (CVE-2024-48974), JTAG memory access (CVE-2024-48970), read-out protection bypass (CVE-2020-8004), missing authentication on service tools (CVE-2024-48966, CVSS 10.0), and insufficient logging (CVE-2024-48967, CVSS 10.0) [2].

6. Consequence & CFSE path analysis

Real-world consequence: an attacker who has recovered the fleet-wide hard-coded clinician password and has local access to a patient’s Life2000 can silently change ventilation/therapy settings on a life-support device, degrading the patient’s safety margins and potentially disrupting oxygen delivery, and can read information off the device — with no rate limiting and little logging to catch it [2]. This impact crosses out of the authentication component into patient safety, and the eventual disposition — a permanent recall rather than a patch [9][10] — is itself a measure of how severe and unfixable-in-place the vendor judged the defect to be.

How and why the CFSE Path Score differs from CVSS: The published CVSS v3.1 score (9.3 CRITICAL) is a single-vector severity rating driven largely by the confidentiality/integrity/availability impact on a life-support device with scope change. It is also the main reason the score stops short of a full 10: the AV:L requirement for local access bounds the vector. The CFSE path analysis instead decomposes the vulnerability into two distinct risk paths and scores what authority each actually reaches and how hard recovery is — which is why it can agree on the top-line verdict while explaining the severity through a different lens (direction SIDEWAYS relative to the CVSS baseline).

Carrying the bands and verdict:

• Supporting path — DEVICE_CONTROL_SAFETY — banded HIGH. Using a recovered clinician credential against a Life2000 requires local/serial proximity. Once authenticated, the attacker changes therapy settings through the device’s normal clinical workflow, reducing patient safety margins on a life-support device — without needing OS or firmware control. The proximity requirement and the fact that authority stays inside the intended clinical workflow keep this path at HIGH rather than CRITICAL.
• Dominant path — ACCOUNT_AUTHORITY — banded CRITICAL. The hard-coded clinician and serial-number-clinician passwords can be extracted from firmware or any device without touching a victim unit, yielding a reusable, fleet-wide shared secret that cannot be rotated without a firmware update. This path caps authority at a bounded clinician-account level (AT low — not root, not firmware-signing) but still reaches a credible severe-therapy consequence and requires fleet-wide / recall-class recovery to fix.

Overall path_verdict: CRITICAL, driven by the dominant account-authority path, direction SIDEWAYS, consistent with the published CVSS v3.1 9.3 CRITICAL baseline. The distinguishing CFSE insight over raw CVSS is the recovery cost: this is not a per-device flaw an operator can patch or a password they can change, but a shared secret whose only true fix is a fleet-wide firmware/product update — a recall-class remediation profile that a single CVSS number does not express. The real-world outcome bears this out exactly: Baxter did not ship a fix and instead permanently removed the product from the field [9][10].

7. Remediation & mitigations

• Definitive vendor action — permanent removal / recall (no patch shipped). The promised Q2 2025 follow-up did not deliver fixed firmware. Baxter’s urgent medical-device recall letter FA-2025-010 (dated 2025-04-10) announced a permanent removal of the Life2000 Ventilation System from the market, citing the cybersecurity issue, and directed customers to discontinue use and consult their healthcare providers about replacement options [9][10]. For a document reviewed in August 2026, this — not a version number — is the authoritative remediation state: the correct action for any fielded Life2000 is to follow the recall and transition off the device.
• Vendor-stated interim mitigation at disclosure (operational only, now superseded by the recall): Baxter recommended that users maintain physical possession and control of the ventilator and not leave it unattended in public or unsecured areas, to reduce the likelihood of malicious local access [2]. This targeted only the AV:L gate — it did nothing about the credential itself — and was the only lever available to operators because the secret cannot be rotated in the field. It has since been overtaken by the permanent-removal decision [9][10].
• Why a code fix was never viable in place. Because the secret is baked into the device in plaintext and shared fleet-wide, a permanent remedy would have required replacing the hard-coded shared credentials with per-device / per-account unique credentials that can be rotated and are stored salted-and-hashed rather than hard-coded in plaintext (implied by CWE-798) [1]. Baxter’s choice to remove the product rather than re-architect its authentication is consistent with the recall-class remediation profile identified in Section 6.
• Detection specific to this bug (for any still-fielded units pending removal): the companion insufficient-logging (CVE-2024-48967) and no-failed-login-limit (CVE-2024-9832) weaknesses mean on-device detection of credential replay is weak; where operationally possible, treat any unexpected clinician-tier setting change as suspect, since the device will not reliably record or rate-limit the login. No network/SOC signature applies here because exploitation is local and uses the device’s legitimate authentication path.

8. Sources

[1] NVD — CVE-2024-48971 — https://nvd.nist.gov/vuln/detail/CVE-2024-48971 — Authoritative record: confirmed the description (plaintext hard-coded Clinician and Serial Number Clinician passwords), CWE-798, CVSS v3.1 9.3 vector, affected version ceiling 06.08.00.00, and publication date. — primary-advisory (NIST NVD).

[2] Baxter Life2000 Ventilation System | CISA ICSMA-24-319-01 — https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01 — Primary ICS-Medical advisory; provided fleet context, self-report status, no-known-exploitation statement, CVSS v4 9.4, the companion-CVE set, impact framing (device disruption / information disclosure), home-use context, and the physical-possession mitigation with Q2 2025 follow-up. — primary-advisory (CISA).

[3] CVE-2024-48971 | CVE.org Record — https://www.cve.org/CVERecord?id=CVE-2024-48971 — Canonical MITRE/CVE.org record confirming the identifier is live with Baxter as CNA. — primary-advisory (CVE.org / MITRE).

[4] Baxter and Welch Allyn Vulnerabilities — Sector Alert (TLP:CLEAR) — https://www.hhs.gov/sites/default/files/baxter-welch-allyn-vulnerabilities-sector-alert-tlpclear.pdf — HHS HC3 healthcare-sector amplification; healthcare operational/impact framing and hospital mitigation guidance. — primary-advisory (US HHS / HC3).

[5] CISA Flags ICS Bugs in Baxter, Mitsubishi Products — https://www.darkreading.com/ics-ot-security/cisa-flags-ics-bugs-in-baxter-mitsubishi-products — Independent security-press coverage placing the hard-coded-credential issue in the broader ICS/medical-device set and patient-safety context. — reputable-press (Dark Reading).

[6] CISA warns of cybersecurity risks in Baxter products — https://www.medtechdive.com/news/cisa-warns-of-cybersecurity-risks-in-baxter-products/718346/ — Medtech trade-press coverage describing the hard-coded credentials, firmware-tampering risk, and potential disruption of oxygen delivery; device-domain reader framing. — reputable-press (MedTech Dive).

[7] CISA issues ICS advisories highlighting vulnerabilities… — https://industrialcyber.co/industrial-cyber-attacks/cisa-issues-ics-advisories-highlighting-vulnerabilities-in-critical-infrastructure-systems-medical-devices/ — ICS/OT press roundup corroborating the Life2000 CVE list and severities. — reputable-press (Industrial Cyber).

[8] Case Study: Baxter Life2000 Ventilator Firmware Tampering — https://www.securebydesignhandbook.com/docs/resources/real-world-vulnerabilities/baxter-life2000-ventilator-tampering — Secure-by-design case study framing the plaintext hard-coded clinician passwords as part of a lifecycle/defense-in-depth failure alongside debug ports, firmware integrity, and logging. No exploit walkthrough; useful for root-cause/design framing. — low credibility (Secure-by-Design Handbook).

[9] URGENT MEDICAL DEVICE RECALL — FA-2025-010 (Baxter US Customer Letter, dated 2025-04-10) — https://www.baxter.com/sites/g/files/ebysai3896/files/2025-08/FA-2025-010-US%20Customer%20Letter-HP-Final-10-Apr-25.pdf — Primary vendor recall communication documenting the permanent removal of the Life2000 Ventilation System over the cybersecurity issue; establishes that no firmware fix shipped and that the Q2 2025 follow-up became a recall. — primary-advisory (Baxter).

[10] Baxter Permanently Removes Life2000 Ventilation System Due to Cybersecurity Issue — https://24x7mag.com/standards/fda-updates/recalls/baxter-permanently-removes-life2000-ventilation-system-due-cybersecurity-issue/ — Medical-device trade-press coverage of the permanent removal/recall: confirms discontinuation rather than a patch, the physical-access-changes-settings framing, and that no serious injuries or deaths were reported as of 2025-04-10. — reputable-press (24x7).