This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GE HealthCare warns of 11 vulnerabilities

Nozomi Networks reports 11 vulnerabilities found in GE HealthCare products, namely in Common Service Desktop and EchoPAC Software Only. Common Service Desktop is an administrative web application preinstalled on several GE HealthCare devices, including ultrasound devices. EchoPAC Software Only is software used to display and analyze outputs from GE HealthCare devices [1][2]. GE HealthCare does not plan to release fixes for these vulnerabilities, so it is strongly recommended to restrict network access to individual vulnerable instances to trusted IP addresses only and also to restrict physical access to trusted persons only. Successful exploitation of the vulnerabilities could lead to theft or corruption of patient data, or to the unavailability of healthcare systems [1][2]. Most serious vulnerabilities:

GE HealthCare EchoPAC - hardcoded credentials (CVE-2024-27107)
CVSS 9.6 (Critical)

An unauthenticated local attacker can gain unauthorized access to the system in EchoPAC by using hardcoded credentials [1].

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 5. 2024.

GE HealthCare EchoPAC - unnecessary privileges (CVE-2024-27109)
CVSS 7.6 (High)

An unauthenticated physical attacker can gain unauthorized access to the system in EchoPAC by using insufficiently secured login credentials [1].

The vulnerability is present in product:

  • https://www.nozominetworks.com/blog/ge-healthcare-vivid-ultrasound-vulnerabilities

CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 5. 2024.

GE HealthCare Common Service Desktop - command injection (CVE-2024-1628)
CVSS 8.4 (High)

An unauthenticated local attacker can run system commands in Common Service Desktop without authorization [1].

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 5. 2024.

GE HealthCare Common Service Desktop - path traversal (CVE-2024-1630)
CVSS 7.7 (High)

An unauthenticated local attacker can carry out a path traversal attack in Common Service Desktop [1].

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 14. 5. 2024.

By CESNET, z.s.p.o. Martin Krajči on 20. 5. 2024.

CESNET, z.s.p.o. Logo