The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance.
Due to insufficient audit logging mechanism (CWE-778), an attacker with physical or logical access to the respirator or Service PC can make unauthorized changes to device settings without leaving traces in system logs. The lack of appropriate logs makes it impossible to detect the incident in real-time or conduct forensic examination after the fact. An attacker can thus operate for an extended period without the awareness of medical staff or IT administrators.
An attacker may make unauthorized changes to respirator operating parameters, which could lead to unauthorized disclosure of data (e.g., patient data) and unintended effects on the medical device operation, potentially threatening patient life.
Apply patches available from the manufacturer according to references (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01). Additionally, it is recommended to restrict physical and logical access to respirators and Service PCs exclusively to authorized personnel, and to implement compensating monitoring mechanisms at the network level or device environment.
Medical respirators (ventilators) and associated service computers (Service PC) — detailed information on specific models and versions is provided in manufacturer references (ICSMA-24-319-01).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H