Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
49 vulnerabilities by GE HealthCare
CVE-2024-27110 (GCVE-0-2024-27110)
Vulnerability from cvelistv5 – Published: 2024-05-14 17:16 – Updated: 2024-08-02 00:27
VLAI
Title
Elevation of privilege vulnerability in GE HealthCare EchoPAC products
Summary
Elevation of privilege vulnerability in GE HealthCare EchoPAC products
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27110",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:22:50.224196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:46:21.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Elevation of privilege vulnerability in GE HealthCare EchoPAC products"
}
],
"value": "Elevation of privilege vulnerability in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-69",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-69 Target Programs with Elevated Privileges"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:16:39.659Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Elevation of privilege vulnerability in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27110",
"datePublished": "2024-05-14T17:16:39.659Z",
"dateReserved": "2024-02-19T15:22:56.573Z",
"dateUpdated": "2024-08-02T00:27:59.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27109 (GCVE-0-2024-27109)
Vulnerability from cvelistv5 – Published: 2024-05-14 17:13 – Updated: 2024-08-02 00:27
VLAI
Title
Insufficiently protected credentials in GE HealthCare EchoPAC products
Summary
Insufficiently protected credentials in GE HealthCare EchoPAC products
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0 , < 206.44
(custom)
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:48.782021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:47:32.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.369Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206.44",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficiently protected credentials in GE HealthCare EchoPAC products"
}
],
"value": "Insufficiently protected credentials in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-653",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-653 Use of Known Operating System Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:13:16.193Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficiently protected credentials in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27109",
"datePublished": "2024-05-14T17:13:16.193Z",
"dateReserved": "2024-02-19T15:22:56.573Z",
"dateUpdated": "2024-08-02T00:27:59.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27108 (GCVE-0-2024-27108)
Vulnerability from cvelistv5 – Published: 2024-05-14 17:09 – Updated: 2024-08-02 00:27
VLAI
Title
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Summary
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:41.993414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:47:18.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:58.693Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products"
}
],
"value": "Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:09:08.166Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27108",
"datePublished": "2024-05-14T17:09:08.166Z",
"dateReserved": "2024-02-19T15:22:56.572Z",
"dateUpdated": "2024-08-02T00:27:58.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27107 (GCVE-0-2024-27107)
Vulnerability from cvelistv5 – Published: 2024-05-14 17:05 – Updated: 2024-08-02 00:27
VLAI
Title
Weak account password in GE HealthCare EchoPAC products
Summary
Weak account password in GE HealthCare EchoPAC products
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0 , < 206.82
(custom)
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:36.437377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:46:35.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.234Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206.82",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Weak account password in GE HealthCare EchoPAC products"
}
],
"value": "Weak account password in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:05:22.568Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Weak account password in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27107",
"datePublished": "2024-05-14T17:05:22.568Z",
"dateReserved": "2024-02-19T15:22:56.572Z",
"dateUpdated": "2024-08-02T00:27:59.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27106 (GCVE-0-2024-27106)
Vulnerability from cvelistv5 – Published: 2024-05-14 17:01 – Updated: 2024-08-02 00:27
VLAI
Title
Vulnerable data in transit in GE HealthCare EchoPAC products
Summary
Vulnerable data in transit in GE HealthCare EchoPAC products
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-311 - Missing Encryption of Sensitive Data
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:29.049031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:46:22.979Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.190Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerable data in transit in GE HealthCare EchoPAC products"
}
],
"value": "Vulnerable data in transit in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-157",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-157 Sniffing Attacks"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311 Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:01:22.488Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Vulnerable data in transit in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27106",
"datePublished": "2024-05-14T17:01:22.488Z",
"dateReserved": "2024-02-19T15:22:56.572Z",
"dateUpdated": "2024-08-02T00:27:59.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1630 (GCVE-0-2024-1630)
Vulnerability from cvelistv5 – Published: 2024-05-14 16:55 – Updated: 2024-08-22 17:51
VLAI
Title
Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Summary
Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
30 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.3 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Voluson Expert 16 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 18 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 22 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson SWIFT |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | LOGIQ E10 |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ E10s |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ Fortis |
Affected:
0 , < R3.2.0
(custom)
|
|
| gehealthcare | venue_firmware |
Affected:
r1
Affected: r2 Affected: r3 , ≤ r3.3 (custom) Affected: r4 , ≤ r4.3 (custom) cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_go_firmware |
Affected:
r2
Affected: r3 , ≤ r3.3 (custom) Affected: r4 , ≤ r4.3 (custom) cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_fit_firmware |
Affected:
r3 , ≤ r3.3
(custom)
Affected: r4 , ≤ r4.3 (custom) cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e_firmware |
Affected:
r7 , ≤ r9.1.4
(custom)
Affected: r8 , ≤ r10.1.3 (custom) Affected: r9 , ≤ r11.0.3 (custom) cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_he_firmware |
Affected:
0 , ≤ r9.3.1
(custom)
cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_e_firmware |
Affected:
e95 , < 206
(custom)
Affected: e90 , < 206 (custom) Affected: e80 , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_t_firmware |
Affected:
t8 , < 206
(custom)
Affected: t9 , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_iq_firmware |
Affected:
0 , < 206
(custom)
cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_expert_16 |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_expert_16:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_expert_18 |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_expert_18:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_expert_22 |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_expert_22:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_swift |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_swift:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e10 |
Affected:
0 , < r3.2.0
(custom)
cpe:2.3:a:gehealthcare:logiq_e10:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e10s |
Affected:
0 , < r3.2.0
(custom)
cpe:2.3:a:gehealthcare:logiq_e10s:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_fortis |
Affected:
0 , < r3.2.0
(custom)
cpe:2.3:a:gehealthcare:logiq_fortis:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:21.818Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "r1"
},
{
"status": "affected",
"version": "r2"
},
{
"lessThanOrEqual": "r3.3",
"status": "affected",
"version": "r3",
"versionType": "custom"
},
{
"lessThanOrEqual": "r4.3",
"status": "affected",
"version": "r4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue_go_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "r2"
},
{
"lessThanOrEqual": "r3.3",
"status": "affected",
"version": "r3",
"versionType": "custom"
},
{
"lessThanOrEqual": "r4.3",
"status": "affected",
"version": "r4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue_fit_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "r3.3",
"status": "affected",
"version": "r3",
"versionType": "custom"
},
{
"lessThanOrEqual": "r4.3",
"status": "affected",
"version": "r4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "r9.1.4",
"status": "affected",
"version": "r7",
"versionType": "custom"
},
{
"lessThanOrEqual": "r10.1.3",
"status": "affected",
"version": "r8",
"versionType": "custom"
},
{
"lessThanOrEqual": "r11.0.3",
"status": "affected",
"version": "r9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_he_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "r9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "e95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "e90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "e80",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid_t_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "t8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "t9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid_iq_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_expert_16:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_expert_16",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_expert_18:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_expert_18",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_expert_22:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_expert_22",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_swift:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_swift",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:logiq_e10:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_e10",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "r3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:logiq_e10s:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_e10s",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "r3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:logiq_fortis:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_fortis",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "r3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1630",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:43:01.721848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T17:51:14.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.3",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 16",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 18",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 22",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson SWIFT",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10s",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ Fortis",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Path traversal vulnerability in \u201cgetAllFolderContents\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"value": "Path traversal vulnerability in \u201cgetAllFolderContents\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T16:55:56.853Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal vulnerability in \u201cgetAllFolderContents\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1630",
"datePublished": "2024-05-14T16:55:56.853Z",
"dateReserved": "2024-02-19T15:28:03.794Z",
"dateUpdated": "2024-08-22T17:51:14.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1629 (GCVE-0-2024-1629)
Vulnerability from cvelistv5 – Published: 2024-05-14 16:32 – Updated: 2024-08-01 18:48
VLAI
Title
Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
Summary
Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.3 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) |
|
| GE HealthCare | Vivid S |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Voluson Expert 16 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 18 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 22 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson SWIFT |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | LOGIQ E10 |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ E10s |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ Fortis |
Affected:
0 , < R3.2.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-16T16:09:37.900864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:01:09.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:21.479Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.3",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid S",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 16",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 18",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 22",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson SWIFT",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10s",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ Fortis",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Path traversal vulnerability in \u201cdeleteFiles\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"value": "Path traversal vulnerability in \u201cdeleteFiles\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T16:32:43.530Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal vulnerability in \u201cdeleteFiles\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1629",
"datePublished": "2024-05-14T16:32:43.530Z",
"dateReserved": "2024-02-19T15:23:21.436Z",
"dateUpdated": "2024-08-01T18:48:21.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1628 (GCVE-0-2024-1628)
Vulnerability from cvelistv5 – Published: 2024-05-14 16:04 – Updated: 2024-08-01 18:48
VLAI
Title
OS command injection vulnerabilities in GE HealthCare ultrasound devices
Summary
OS command injection vulnerabilities in GE HealthCare ultrasound devices
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
21 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.3 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) |
|
| GE HealthCare | Vivid S |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Voluson Expert 16 |
Affected:
0
Affected: BT24 , < Ext1 (custom) |
|
| GE HealthCare | Voluson Expert 18 |
Affected:
0
Affected: BT24 , < Ext1 (custom) |
|
| GE HealthCare | Voluson Expert 22 |
Affected:
0
Affected: BT24 , < Ext1 (custom) |
|
| GE HealthCare | Voluson SWIFT |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Invenia ABUS 2.0 |
Affected:
0 , ≤ 2.2.7
(custom)
|
|
| GE HealthCare | LOGIQ E10 |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ E10s |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ Fortis |
Affected:
0 , < R3.2.0
(custom)
|
|
| ge_healthcare | venue |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:venue:*:*:*:*:*:*:*:* |
|
| ge_healthcare | vivid |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:vivid:*:*:*:*:*:*:*:* |
|
| ge_healthcare | voluson |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:voluson:*:*:*:*:*:*:*:* |
|
| ge_healthcare | logiq |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:logiq:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ge_healthcare:venue:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
},
{
"cpes": [
"cpe:2.3:a:ge_healthcare:vivid:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
},
{
"cpes": [
"cpe:2.3:a:ge_healthcare:voluson:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
},
{
"cpes": [
"cpe:2.3:a:ge_healthcare:logiq:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1628",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-16T16:10:00.517201Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:01:30.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:21.580Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.3",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid S",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 16",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"lessThan": "Ext1",
"status": "affected",
"version": "BT24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 18",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"lessThan": "Ext1",
"status": "affected",
"version": "BT24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 22",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"lessThan": "Ext1",
"status": "affected",
"version": "BT24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson SWIFT",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Invenia ABUS 2.0",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "2.2.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10s",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ Fortis",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OS command injection vulnerabilities in GE HealthCare ultrasound devices"
}
],
"value": "OS command injection vulnerabilities in GE HealthCare ultrasound devices"
}
],
"impacts": [
{
"capecId": "CAPEC-6",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-6 Argument Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T16:04:57.780Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS command injection vulnerabilities in GE HealthCare ultrasound devices",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1628",
"datePublished": "2024-05-14T16:04:57.780Z",
"dateReserved": "2024-02-19T15:23:20.113Z",
"dateUpdated": "2024-08-01T18:48:21.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1486 (GCVE-0-2024-1486)
Vulnerability from cvelistv5 – Published: 2024-05-14 15:10 – Updated: 2024-08-16 18:15
VLAI
Title
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Summary
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
22 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.2 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.2 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) Affected: E9 113.2 , ≤ 113.2 (custom) |
|
| GE HealthCare | Vivid S |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Invenia ABUS |
Affected:
1.2.3
|
|
| GE HealthCare | Invenia ABUS 2.0 |
Affected:
0 , < 2.2.9
(custom)
|
|
| gehealthcare | venue_firmware |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_go_firmware |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_fit_firmware |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.2 (custom) cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e_firmware |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.2 (custom) cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_he_firmware |
Affected:
0 , ≤ R9.3.1
(custom)
cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_e_firmware |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) Affected: E9 113.2 , ≤ 113.2 (custom) cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_s_firmware |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_s_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_t_firmware |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_iq_firmware |
Affected:
0 , < 206
(custom)
cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | invenia_abus_firmware |
Affected:
1.2.3
cpe:2.3:o:gehealthcare:invenia_abus_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | invenia_abus_2.0_firmware |
Affected:
0 , < 2.2.9
(custom)
cpe:2.3:o:gehealthcare:invenia_abus_2.0_firmware:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:40:21.121Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "venue_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "venue_go_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "venue_fit_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "logiq_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.2",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "logiq_he_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
},
{
"lessThanOrEqual": "113.2",
"status": "affected",
"version": "E9 113.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_s_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_s_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_t_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_iq_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:invenia_abus_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "invenia_abus_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "1.2.3"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:invenia_abus_2.0_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "invenia_abus_2.0_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "2.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T14:08:59.014421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T18:15:02.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.2",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
},
{
"lessThanOrEqual": "113.2",
"status": "affected",
"version": "E9 113.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid S",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Invenia ABUS",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "1.2.3"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Invenia ABUS 2.0",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "2.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices"
}
],
"value": "Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T15:10:22.262Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1486",
"datePublished": "2024-05-14T15:10:22.262Z",
"dateReserved": "2024-02-13T22:34:57.386Z",
"dateUpdated": "2024-08-16T18:15:02.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27110 (GCVE-0-2024-27110)
Vulnerability from nvd – Published: 2024-05-14 17:16 – Updated: 2024-08-02 00:27
VLAI
Title
Elevation of privilege vulnerability in GE HealthCare EchoPAC products
Summary
Elevation of privilege vulnerability in GE HealthCare EchoPAC products
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27110",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:22:50.224196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:46:21.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Elevation of privilege vulnerability in GE HealthCare EchoPAC products"
}
],
"value": "Elevation of privilege vulnerability in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-69",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-69 Target Programs with Elevated Privileges"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:16:39.659Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Elevation of privilege vulnerability in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27110",
"datePublished": "2024-05-14T17:16:39.659Z",
"dateReserved": "2024-02-19T15:22:56.573Z",
"dateUpdated": "2024-08-02T00:27:59.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27109 (GCVE-0-2024-27109)
Vulnerability from nvd – Published: 2024-05-14 17:13 – Updated: 2024-08-02 00:27
VLAI
Title
Insufficiently protected credentials in GE HealthCare EchoPAC products
Summary
Insufficiently protected credentials in GE HealthCare EchoPAC products
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0 , < 206.44
(custom)
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:48.782021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:47:32.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.369Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206.44",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficiently protected credentials in GE HealthCare EchoPAC products"
}
],
"value": "Insufficiently protected credentials in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-653",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-653 Use of Known Operating System Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:13:16.193Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficiently protected credentials in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27109",
"datePublished": "2024-05-14T17:13:16.193Z",
"dateReserved": "2024-02-19T15:22:56.573Z",
"dateUpdated": "2024-08-02T00:27:59.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27108 (GCVE-0-2024-27108)
Vulnerability from nvd – Published: 2024-05-14 17:09 – Updated: 2024-08-02 00:27
VLAI
Title
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Summary
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:41.993414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:47:18.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:58.693Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products"
}
],
"value": "Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:09:08.166Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27108",
"datePublished": "2024-05-14T17:09:08.166Z",
"dateReserved": "2024-02-19T15:22:56.572Z",
"dateUpdated": "2024-08-02T00:27:58.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27107 (GCVE-0-2024-27107)
Vulnerability from nvd – Published: 2024-05-14 17:05 – Updated: 2024-08-02 00:27
VLAI
Title
Weak account password in GE HealthCare EchoPAC products
Summary
Weak account password in GE HealthCare EchoPAC products
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0 , < 206.82
(custom)
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:36.437377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:46:35.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.234Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206.82",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Weak account password in GE HealthCare EchoPAC products"
}
],
"value": "Weak account password in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:05:22.568Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Weak account password in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27107",
"datePublished": "2024-05-14T17:05:22.568Z",
"dateReserved": "2024-02-19T15:22:56.572Z",
"dateUpdated": "2024-08-02T00:27:59.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27106 (GCVE-0-2024-27106)
Vulnerability from nvd – Published: 2024-05-14 17:01 – Updated: 2024-08-02 00:27
VLAI
Title
Vulnerable data in transit in GE HealthCare EchoPAC products
Summary
Vulnerable data in transit in GE HealthCare EchoPAC products
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-311 - Missing Encryption of Sensitive Data
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | EchoPAC Software Only |
Affected:
0
|
|
| GE HealthCare | ImageVault |
Affected:
0
|
|
| GE HealthCare | EchoPAC Turnkey |
Affected:
0
|
|
| gehealthcare | image_vault |
Affected:
-
cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_software |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:* |
|
| gehealthcare | echopac_turnkey |
Affected:
-
cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:gehealthcare:image_vault:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "image_vault",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_software:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_software",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:echopac_turnkey:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "echopac_turnkey",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:31:29.049031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:46:22.979Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.190Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EchoPAC Software Only",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageVault",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EchoPAC Turnkey",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerable data in transit in GE HealthCare EchoPAC products"
}
],
"value": "Vulnerable data in transit in GE HealthCare EchoPAC products"
}
],
"impacts": [
{
"capecId": "CAPEC-157",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-157 Sniffing Attacks"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311 Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T17:01:22.488Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Vulnerable data in transit in GE HealthCare EchoPAC products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-27106",
"datePublished": "2024-05-14T17:01:22.488Z",
"dateReserved": "2024-02-19T15:22:56.572Z",
"dateUpdated": "2024-08-02T00:27:59.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1630 (GCVE-0-2024-1630)
Vulnerability from nvd – Published: 2024-05-14 16:55 – Updated: 2024-08-22 17:51
VLAI
Title
Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Summary
Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
30 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.3 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Voluson Expert 16 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 18 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 22 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson SWIFT |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | LOGIQ E10 |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ E10s |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ Fortis |
Affected:
0 , < R3.2.0
(custom)
|
|
| gehealthcare | venue_firmware |
Affected:
r1
Affected: r2 Affected: r3 , ≤ r3.3 (custom) Affected: r4 , ≤ r4.3 (custom) cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_go_firmware |
Affected:
r2
Affected: r3 , ≤ r3.3 (custom) Affected: r4 , ≤ r4.3 (custom) cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_fit_firmware |
Affected:
r3 , ≤ r3.3
(custom)
Affected: r4 , ≤ r4.3 (custom) cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e_firmware |
Affected:
r7 , ≤ r9.1.4
(custom)
Affected: r8 , ≤ r10.1.3 (custom) Affected: r9 , ≤ r11.0.3 (custom) cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_he_firmware |
Affected:
0 , ≤ r9.3.1
(custom)
cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_e_firmware |
Affected:
e95 , < 206
(custom)
Affected: e90 , < 206 (custom) Affected: e80 , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_t_firmware |
Affected:
t8 , < 206
(custom)
Affected: t9 , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_iq_firmware |
Affected:
0 , < 206
(custom)
cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_expert_16 |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_expert_16:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_expert_18 |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_expert_18:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_expert_22 |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_expert_22:*:*:*:*:*:*:*:* |
|
| gehealthcare | voluson_swift |
Affected:
0
Affected: bt24 cpe:2.3:a:gehealthcare:voluson_swift:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e10 |
Affected:
0 , < r3.2.0
(custom)
cpe:2.3:a:gehealthcare:logiq_e10:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e10s |
Affected:
0 , < r3.2.0
(custom)
cpe:2.3:a:gehealthcare:logiq_e10s:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_fortis |
Affected:
0 , < r3.2.0
(custom)
cpe:2.3:a:gehealthcare:logiq_fortis:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:21.818Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "r1"
},
{
"status": "affected",
"version": "r2"
},
{
"lessThanOrEqual": "r3.3",
"status": "affected",
"version": "r3",
"versionType": "custom"
},
{
"lessThanOrEqual": "r4.3",
"status": "affected",
"version": "r4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue_go_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "r2"
},
{
"lessThanOrEqual": "r3.3",
"status": "affected",
"version": "r3",
"versionType": "custom"
},
{
"lessThanOrEqual": "r4.3",
"status": "affected",
"version": "r4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue_fit_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "r3.3",
"status": "affected",
"version": "r3",
"versionType": "custom"
},
{
"lessThanOrEqual": "r4.3",
"status": "affected",
"version": "r4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "r9.1.4",
"status": "affected",
"version": "r7",
"versionType": "custom"
},
{
"lessThanOrEqual": "r10.1.3",
"status": "affected",
"version": "r8",
"versionType": "custom"
},
{
"lessThanOrEqual": "r11.0.3",
"status": "affected",
"version": "r9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_he_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "r9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "e95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "e90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "e80",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid_t_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "t8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "t9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid_iq_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_expert_16:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_expert_16",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_expert_18:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_expert_18",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_expert_22:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_expert_22",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:voluson_swift:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson_swift",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "bt24"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:logiq_e10:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_e10",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "r3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:logiq_e10s:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_e10s",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "r3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:gehealthcare:logiq_fortis:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq_fortis",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "r3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1630",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:43:01.721848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T17:51:14.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.3",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 16",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 18",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 22",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson SWIFT",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10s",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ Fortis",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Path traversal vulnerability in \u201cgetAllFolderContents\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"value": "Path traversal vulnerability in \u201cgetAllFolderContents\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T16:55:56.853Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal vulnerability in \u201cgetAllFolderContents\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1630",
"datePublished": "2024-05-14T16:55:56.853Z",
"dateReserved": "2024-02-19T15:28:03.794Z",
"dateUpdated": "2024-08-22T17:51:14.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1629 (GCVE-0-2024-1629)
Vulnerability from nvd – Published: 2024-05-14 16:32 – Updated: 2024-08-01 18:48
VLAI
Title
Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
Summary
Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.3 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) |
|
| GE HealthCare | Vivid S |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Voluson Expert 16 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 18 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson Expert 22 |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Voluson SWIFT |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | LOGIQ E10 |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ E10s |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ Fortis |
Affected:
0 , < R3.2.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-16T16:09:37.900864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:01:09.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:21.479Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.3",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid S",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 16",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 18",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 22",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson SWIFT",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10s",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ Fortis",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Path traversal vulnerability in \u201cdeleteFiles\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"value": "Path traversal vulnerability in \u201cdeleteFiles\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T16:32:43.530Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal vulnerability in \u201cdeleteFiles\u201d function of Common Service Desktop, a GE HealthCare ultrasound device component",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1629",
"datePublished": "2024-05-14T16:32:43.530Z",
"dateReserved": "2024-02-19T15:23:21.436Z",
"dateUpdated": "2024-08-01T18:48:21.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1628 (GCVE-0-2024-1628)
Vulnerability from nvd – Published: 2024-05-14 16:04 – Updated: 2024-08-01 18:48
VLAI
Title
OS command injection vulnerabilities in GE HealthCare ultrasound devices
Summary
OS command injection vulnerabilities in GE HealthCare ultrasound devices
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
21 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.3 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.3 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) |
|
| GE HealthCare | Vivid S |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Voluson Expert 16 |
Affected:
0
Affected: BT24 , < Ext1 (custom) |
|
| GE HealthCare | Voluson Expert 18 |
Affected:
0
Affected: BT24 , < Ext1 (custom) |
|
| GE HealthCare | Voluson Expert 22 |
Affected:
0
Affected: BT24 , < Ext1 (custom) |
|
| GE HealthCare | Voluson SWIFT |
Affected:
0
Affected: BT24 |
|
| GE HealthCare | Invenia ABUS 2.0 |
Affected:
0 , ≤ 2.2.7
(custom)
|
|
| GE HealthCare | LOGIQ E10 |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ E10s |
Affected:
0 , < R3.2.0
(custom)
|
|
| GE HealthCare | LOGIQ Fortis |
Affected:
0 , < R3.2.0
(custom)
|
|
| ge_healthcare | venue |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:venue:*:*:*:*:*:*:*:* |
|
| ge_healthcare | vivid |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:vivid:*:*:*:*:*:*:*:* |
|
| ge_healthcare | voluson |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:voluson:*:*:*:*:*:*:*:* |
|
| ge_healthcare | logiq |
Affected:
multiple versions
cpe:2.3:a:ge_healthcare:logiq:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ge_healthcare:venue:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "venue",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
},
{
"cpes": [
"cpe:2.3:a:ge_healthcare:vivid:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vivid",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
},
{
"cpes": [
"cpe:2.3:a:ge_healthcare:voluson:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "voluson",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
},
{
"cpes": [
"cpe:2.3:a:ge_healthcare:logiq:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "logiq",
"vendor": "ge_healthcare",
"versions": [
{
"status": "affected",
"version": "multiple versions"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1628",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-16T16:10:00.517201Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:01:30.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:21.580Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.3",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.3",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid S",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 16",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"lessThan": "Ext1",
"status": "affected",
"version": "BT24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 18",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"lessThan": "Ext1",
"status": "affected",
"version": "BT24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson Expert 22",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"lessThan": "Ext1",
"status": "affected",
"version": "BT24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Voluson SWIFT",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "0"
},
{
"status": "affected",
"version": "BT24"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Invenia ABUS 2.0",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "2.2.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ E10s",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ Fortis",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "R3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OS command injection vulnerabilities in GE HealthCare ultrasound devices"
}
],
"value": "OS command injection vulnerabilities in GE HealthCare ultrasound devices"
}
],
"impacts": [
{
"capecId": "CAPEC-6",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-6 Argument Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T16:04:57.780Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS command injection vulnerabilities in GE HealthCare ultrasound devices",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1628",
"datePublished": "2024-05-14T16:04:57.780Z",
"dateReserved": "2024-02-19T15:23:20.113Z",
"dateUpdated": "2024-08-01T18:48:21.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1486 (GCVE-0-2024-1486)
Vulnerability from nvd – Published: 2024-05-14 15:10 – Updated: 2024-08-16 18:15
VLAI
Title
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Summary
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
22 products
| Vendor | Product | Version | |
|---|---|---|---|
| GE HealthCare | Venue |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) |
|
| GE HealthCare | Venue Go |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) |
|
| GE HealthCare | Venue Fit |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.2 (custom) |
|
| GE HealthCare | LOGIQ e |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.2 (custom) |
|
| GE HealthCare | LOGIQ He |
Affected:
0 , ≤ R9.3.1
(custom)
|
|
| GE HealthCare | Vivid E |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) Affected: E9 113.2 , ≤ 113.2 (custom) |
|
| GE HealthCare | Vivid S |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) |
|
| GE HealthCare | Vivid T |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) |
|
| GE HealthCare | Vivid iq |
Affected:
0 , < 206
(custom)
|
|
| GE HealthCare | Invenia ABUS |
Affected:
1.2.3
|
|
| GE HealthCare | Invenia ABUS 2.0 |
Affected:
0 , < 2.2.9
(custom)
|
|
| gehealthcare | venue_firmware |
Affected:
R1
Affected: R2 Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_go_firmware |
Affected:
R2
Affected: R3 , ≤ R3.3 (custom) Affected: R4 , ≤ R4.2 (custom) cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | venue_fit_firmware |
Affected:
R3 , ≤ R3.3
(custom)
Affected: R4 , ≤ R4.2 (custom) cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_e_firmware |
Affected:
R7 , ≤ R9.1.4
(custom)
Affected: R8 , ≤ R10.1.3 (custom) Affected: R9 , ≤ R11.0.2 (custom) cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | logiq_he_firmware |
Affected:
0 , ≤ R9.3.1
(custom)
cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_e_firmware |
Affected:
E95 , < 206
(custom)
Affected: E90 , < 206 (custom) Affected: E80 , < 206 (custom) Affected: E9 113.2 , ≤ 113.2 (custom) cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_s_firmware |
Affected:
70N , < 206
(custom)
Affected: 60N , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_s_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_t_firmware |
Affected:
T8 , < 206
(custom)
Affected: T9 , < 206 (custom) cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | vivid_iq_firmware |
Affected:
0 , < 206
(custom)
cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | invenia_abus_firmware |
Affected:
1.2.3
cpe:2.3:o:gehealthcare:invenia_abus_firmware:*:*:*:*:*:*:*:* |
|
| gehealthcare | invenia_abus_2.0_firmware |
Affected:
0 , < 2.2.9
(custom)
cpe:2.3:o:gehealthcare:invenia_abus_2.0_firmware:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:40:21.121Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securityupdate.gehealthcare.com/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "venue_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "venue_go_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "venue_fit_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "logiq_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.2",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "logiq_he_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_e_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
},
{
"lessThanOrEqual": "113.2",
"status": "affected",
"version": "E9 113.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_s_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_s_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_t_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "vivid_iq_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:invenia_abus_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "invenia_abus_firmware",
"vendor": "gehealthcare",
"versions": [
{
"status": "affected",
"version": "1.2.3"
}
]
},
{
"cpes": [
"cpe:2.3:o:gehealthcare:invenia_abus_2.0_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "invenia_abus_2.0_firmware",
"vendor": "gehealthcare",
"versions": [
{
"lessThan": "2.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T14:08:59.014421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T18:15:02.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venue",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R1"
},
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Go",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "R2"
},
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venue Fit",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R3.3",
"status": "affected",
"version": "R3",
"versionType": "custom"
},
{
"lessThanOrEqual": "R4.2",
"status": "affected",
"version": "R4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ e",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.1.4",
"status": "affected",
"version": "R7",
"versionType": "custom"
},
{
"lessThanOrEqual": "R10.1.3",
"status": "affected",
"version": "R8",
"versionType": "custom"
},
{
"lessThanOrEqual": "R11.0.2",
"status": "affected",
"version": "R9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "LOGIQ He",
"vendor": "GE HealthCare",
"versions": [
{
"lessThanOrEqual": "R9.3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid E",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "E95",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E90",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "E80",
"versionType": "custom"
},
{
"lessThanOrEqual": "113.2",
"status": "affected",
"version": "E9 113.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid S",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "70N",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "60N",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid T",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "T8",
"versionType": "custom"
},
{
"lessThan": "206",
"status": "affected",
"version": "T9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vivid iq",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "206",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Invenia ABUS",
"vendor": "GE HealthCare",
"versions": [
{
"status": "affected",
"version": "1.2.3"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Invenia ABUS 2.0",
"vendor": "GE HealthCare",
"versions": [
{
"lessThan": "2.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices"
}
],
"value": "Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-14T15:10:22.262Z",
"orgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"shortName": "GEHC"
},
"references": [
{
"url": "https://securityupdate.gehealthcare.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "171caf72-b841-4e04-a68e-93493aff2b94",
"assignerShortName": "GEHC",
"cveId": "CVE-2024-1486",
"datePublished": "2024-05-14T15:10:22.262Z",
"dateReserved": "2024-02-13T22:34:57.386Z",
"dateUpdated": "2024-08-16T18:15:02.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-201508-0011
Vulnerability from variot - Updated: 2024-02-13 22:34GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and attack vectors. GE Healthcare CADStream Server is a suite of applications for the medical industry that provide automated analysis and reporting for magnetic resonance imaging.
GE Healthcare CADStream Server has built-in accounts. The admin uses a 'confirma' password, allowing remote attackers to use these accounts to control the device. An attacker can exploit this issue to gain unauthorized access to the affected device. Successful exploits will result in the complete compromise of the affected device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0011",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cadstream server",
"scope": "eq",
"trust": 1.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "cadstream server",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "cadstream server",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "cadstream server",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"db": "BID",
"id": "76185"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-023"
},
{
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:cadstream_server_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven",
"sources": [
{
"db": "BID",
"id": "76185"
}
],
"trust": 0.3
},
"cve": "CVE-2010-5309",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-5309",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05171",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-47914",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-5309",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05171",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-023",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-47914",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2010-5309",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"db": "VULHUB",
"id": "VHN-47914"
},
{
"db": "VULMON",
"id": "CVE-2010-5309"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-023"
},
{
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and attack vectors. GE Healthcare CADStream Server is a suite of applications for the medical industry that provide automated analysis and reporting for magnetic resonance imaging. \n\nGE Healthcare CADStream Server has built-in accounts. The admin uses a \u0027confirma\u0027 password, allowing remote attackers to use these accounts to control the device. \nAn attacker can exploit this issue to gain unauthorized access to the affected device. Successful exploits will result in the complete compromise of the affected device",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-5309"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"db": "BID",
"id": "76185"
},
{
"db": "VULHUB",
"id": "VHN-47914"
},
{
"db": "VULMON",
"id": "CVE-2010-5309"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-5309",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-037-02",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201508-023",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-05171",
"trust": 0.6
},
{
"db": "BID",
"id": "76185",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-47914",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2010-5309",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"db": "VULHUB",
"id": "VHN-47914"
},
{
"db": "VULMON",
"id": "CVE-2010-5309"
},
{
"db": "BID",
"id": "76185"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-023"
},
{
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"id": "VAR-201508-0011",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-47914"
}
],
"trust": 0.01
},
"last_update_date": "2024-02-13T22:34:36.627000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Optima MR360 1.5T MR system Operator Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/mr360+operator+manual+paper.pdf?req=raa\u0026direction=5339461-1en\u0026filename=mr360%2boperator%2bmanual%2bpaper.pdf\u0026filerev=4\u0026docrev_org=4"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-47914"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.5,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
},
{
"trust": 1.8,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 1.7,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/mr360+operator+manual+paper.pdf?req=raa\u0026direction=5339461-1en\u0026filename=mr360%2boperator%2bmanual%2bpaper.pdf\u0026filerev=4\u0026docrev_org=4"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-5309"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-5309"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en/global_gateway"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/mr360+operator+manual+paper.pdf?req=raa\u0026amp;direction=5339461-1en\u0026amp;filename=mr360%2boperator%2bmanual%2bpaper.pdf\u0026amp;filerev=4\u0026amp;docrev_org=4"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/255.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"db": "VULHUB",
"id": "VHN-47914"
},
{
"db": "VULMON",
"id": "CVE-2010-5309"
},
{
"db": "BID",
"id": "76185"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-023"
},
{
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"db": "VULHUB",
"id": "VHN-47914"
},
{
"db": "VULMON",
"id": "CVE-2010-5309"
},
{
"db": "BID",
"id": "76185"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-023"
},
{
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-47914"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2010-5309"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76185"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-023"
},
{
"date": "2015-08-04T14:59:12.457000",
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05171"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULHUB",
"id": "VHN-47914"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULMON",
"id": "CVE-2010-5309"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76185"
},
{
"date": "2018-04-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004016"
},
{
"date": "2015-08-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-023"
},
{
"date": "2018-03-28T01:29:01.497000",
"db": "NVD",
"id": "CVE-2010-5309"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-023"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare CADStream Server Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004016"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-023"
}
],
"trust": 0.6
}
}
VAR-201508-0013
Vulnerability from variot - Updated: 2023-12-18 13:57GE Healthcare Infinia II has a default password of (1) infinia for the infinia user, (2) #bigguy1 for the acqservice user, (3) dont4get2 for the Administrator user, (4) #bigguy1 for the emergency user, and (5) 2Bfamous for the InfiniaAdmin user, which has unspecified impact and attack vectors. GE Healthcare Infinia II is a dual detector imaging system for the medical industry at General Electric (GE). An attacker could exploit this vulnerability to control the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0013",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "infinia ii",
"scope": "eq",
"trust": 1.0,
"vendor": "gehealthcare",
"version": "*"
},
{
"model": "infinia ii",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "healthcare infinia ii",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "infinia ii",
"scope": null,
"trust": 0.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "infinia ii",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"db": "BID",
"id": "76179"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:infinia_ii:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-7253"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven",
"sources": [
{
"db": "BID",
"id": "76179"
}
],
"trust": 0.3
},
"cve": "CVE-2006-7253",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2006-7253",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05143",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-7253",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05143",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-017",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Infinia II has a default password of (1) infinia for the infinia user, (2) #bigguy1 for the acqservice user, (3) dont4get2 for the Administrator user, (4) #bigguy1 for the emergency user, and (5) 2Bfamous for the InfiniaAdmin user, which has unspecified impact and attack vectors. GE Healthcare Infinia II is a dual detector imaging system for the medical industry at General Electric (GE). An attacker could exploit this vulnerability to control the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"db": "BID",
"id": "76179"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-7253",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003996",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-05143",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-017",
"trust": 0.6
},
{
"db": "BID",
"id": "76179",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"db": "BID",
"id": "76179"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
]
},
"id": "VAR-201508-0013",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
}
]
},
"last_update_date": "2023-12-18T13:57:35.920000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Infinia II System Service Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/h-xw4100+workstation.pdf?req=raa\u0026direction=2411012-100\u0026filename=h-xw4100%2bworkstation.pdf\u0026filerev=6\u0026docrev_org=6"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"db": "NVD",
"id": "CVE-2006-7253"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 1.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/h-xw4100+workstation.pdf?req=raa\u0026direction=2411012-100\u0026filename=h-xw4100%2bworkstation.pdf\u0026filerev=6\u0026docrev_org=6"
},
{
"trust": 1.6,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-7253"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-7253"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en/products/categories/goldseal_-_refurbished_systems/goldseal_nuclear_medicine/goldseal_infinia_ii"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"db": "BID",
"id": "76179"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"db": "BID",
"id": "76179"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76179"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"date": "2015-08-04T14:59:06.237000",
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76179"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003996"
},
{
"date": "2015-08-11T14:36:42.577000",
"db": "NVD",
"id": "CVE-2006-7253"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Infinia II Trust Management Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05143"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-017"
}
],
"trust": 0.6
}
}
VAR-201508-0152
Vulnerability from variot - Updated: 2023-12-18 13:44The Ad Hoc Reporting feature in GE Healthcare Centricity DMS 4.2 has a password of Never!Mind for the Administrator user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. GE Healthcare Centricity DMS is a cardiology clinical education data management system for the medical industry from General Electric (GE). An attacker could use this vulnerability to control the device. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0152",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "centricity dms",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.2"
},
{
"model": "centricity cardiology data management system",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.2"
},
{
"model": "centricity dms",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.2"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"db": "BID",
"id": "76166"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_dms:4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7405"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "76166"
}
],
"trust": 0.3
},
"cve": "CVE-2013-7405",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2013-7405",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05138",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-7405",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05138",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-033",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2013-7405",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"db": "VULMON",
"id": "CVE-2013-7405"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Ad Hoc Reporting feature in GE Healthcare Centricity DMS 4.2 has a password of Never!Mind for the Administrator user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. GE Healthcare Centricity DMS is a cardiology clinical education data management system for the medical industry from General Electric (GE). An attacker could use this vulnerability to control the device. \nAttackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"db": "BID",
"id": "76166"
},
{
"db": "VULMON",
"id": "CVE-2013-7405"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-7405",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004008",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-05138",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-033",
"trust": 0.6
},
{
"db": "BID",
"id": "76166",
"trust": 0.4
},
{
"db": "VULMON",
"id": "CVE-2013-7405",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"db": "VULMON",
"id": "CVE-2013-7405"
},
{
"db": "BID",
"id": "76166"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
]
},
"id": "VAR-201508-0152",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
}
]
},
"last_update_date": "2023-12-18T13:44:19.418000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Centricity* Cardiology Data Management System DMS Admin. - v. 4.2 Master Trainer Guide",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/0908141_dms%204.2%20mtg.pdf?docclass=a\u0026req=rac\u0026direction=0908141\u0026filename=0908141_dms+4.2+mtg.pdf\u0026filerev=d\u0026docrev_org=d\u0026submit=+accept+"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"db": "NVD",
"id": "CVE-2013-7405"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 1.7,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/0908141_dms+4.2+mtg.pdf?req=raa\u0026direction=0908141\u0026filename=0908141_dms%2b4.2%2bmtg.pdf\u0026filerev=d\u0026docrev_org=d"
},
{
"trust": 1.7,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7405"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7405"
},
{
"trust": 0.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/0908141_dms+4.2+mtg.pdf?req=raa\u0026amp;direction=0908141\u0026amp;filename=0908141_dms%2b4.2%2bmtg.pdf\u0026amp;filerev=d\u0026amp;docrev_org=d"
},
{
"trust": 0.3,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/0908141_dms%204.2%20mtg.pdf?docclass=a\u0026req=rac\u0026direction=0908141\u0026filename=0908141_dms+4.2+mtg.pdf\u0026filerev=d\u0026docrev_org=d\u0026submit=+accept+"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/255.html"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/76166"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"db": "VULMON",
"id": "CVE-2013-7405"
},
{
"db": "BID",
"id": "76166"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"db": "VULMON",
"id": "CVE-2013-7405"
},
{
"db": "BID",
"id": "76166"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2013-7405"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76166"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"date": "2015-08-04T14:59:22.643000",
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2013-7405"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76166"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004008"
},
{
"date": "2015-08-04T19:24:23.680000",
"db": "NVD",
"id": "CVE-2013-7405"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity DMS Ad Hoc Reporting Trust Management Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05138"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-033"
}
],
"trust": 0.6
}
}
VAR-201508-0005
Vulnerability from variot - Updated: 2023-12-18 13:09GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of (1) root.genie for the root user, (2) "service." for the service user, (3) admin.genie for the admin user, (4) reboot for the reboot user, and (5) shutdown for the shutdown user, which has unspecified impact and attack vectors. GE Healthcare Millennium MG, NC, and MyoSIGHT are all scanning cameras for the medical industry from General Electric (GE).
There are security vulnerabilities in several GE products. An attacker could use this vulnerability to control the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0005",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "millennium mg",
"scope": "eq",
"trust": 1.0,
"vendor": "gehealthcare",
"version": "*"
},
{
"model": "millennium nc",
"scope": "eq",
"trust": 1.0,
"vendor": "gehealthcare",
"version": "*"
},
{
"model": "millennium myosight",
"scope": "eq",
"trust": 1.0,
"vendor": "gehealthcare",
"version": "*"
},
{
"model": "millennium mg",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "millennium myosight",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "millennium nc",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "healthcare millennium mg/nc/myosight",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "millennium myosight",
"scope": null,
"trust": 0.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "millennium nc",
"scope": null,
"trust": 0.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "millennium mg",
"scope": null,
"trust": 0.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "millennium nc",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
},
{
"model": "millennium myosight",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
},
{
"model": "millennium mg",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"db": "BID",
"id": "86877"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:millennium_mg:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:millennium_myosight:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:millennium_nc:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-2445"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "86877"
}
],
"trust": 0.3
},
"cve": "CVE-2002-2445",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2002-2445",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05133",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2002-2445",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05133",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-013",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2002-2445",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"db": "VULMON",
"id": "CVE-2002-2445"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of (1) root.genie for the root user, (2) \"service.\" for the service user, (3) admin.genie for the admin user, (4) reboot for the reboot user, and (5) shutdown for the shutdown user, which has unspecified impact and attack vectors. GE Healthcare Millennium MG, NC, and MyoSIGHT are all scanning cameras for the medical industry from General Electric (GE). \n\nThere are security vulnerabilities in several GE products. An attacker could use this vulnerability to control the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"db": "BID",
"id": "86877"
},
{
"db": "VULMON",
"id": "CVE-2002-2445"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2002-2445",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003992",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-05133",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-013",
"trust": 0.6
},
{
"db": "BID",
"id": "86877",
"trust": 0.4
},
{
"db": "VULMON",
"id": "CVE-2002-2445",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"db": "VULMON",
"id": "CVE-2002-2445"
},
{
"db": "BID",
"id": "86877"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
]
},
"id": "VAR-201508-0005",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05133"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05133"
}
]
},
"last_update_date": "2023-12-18T13:09:10.346000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Millennium MyoSIGHT Nuclear Medicine Imaging System Service Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2354459-100.pdf?req=raa\u0026direction=2354459-100\u0026filename=2354459-100.pdf\u0026filerev=4\u0026docrev_org=4"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www3.gehealthcare.com/en/global_gateway"
},
{
"title": "Millenium MG \u0026 MC Nuclear Medicine Imaging System Service Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2338955-100.pdf?req=raa\u0026direction=2338955-100\u0026filename=2338955-100.pdf\u0026filerev=1\u0026docrev_org=1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-2445"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.0,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2338955-100.pdf?req=raa\u0026direction=2338955-100\u0026filename=2338955-100.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"trust": 2.0,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2354459-100.pdf?req=raa\u0026direction=2354459-100\u0026filename=2354459-100.pdf\u0026filerev=4\u0026docrev_org=4"
},
{
"trust": 2.0,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-2445"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2002-2445"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/86877"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"db": "VULMON",
"id": "CVE-2002-2445"
},
{
"db": "BID",
"id": "86877"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"db": "VULMON",
"id": "CVE-2002-2445"
},
{
"db": "BID",
"id": "86877"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2002-2445"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "86877"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"date": "2015-08-04T14:59:01.817000",
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05133"
},
{
"date": "2015-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2002-2445"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "86877"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003992"
},
{
"date": "2015-09-03T14:55:01.187000",
"db": "NVD",
"id": "CVE-2002-2445"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural GE Healthcare Millennium Product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-003992"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-013"
}
],
"trust": 0.6
}
}
VAR-201508-0526
Vulnerability from variot - Updated: 2023-12-18 12:44GE Healthcare Centricity Clinical Archive Audit Trail Repository has a default password of initinit for the (1) SSL key manager and (2) server keystore; (3) keystore_password for the server truststore; and atna for the (4) primary storage database and (5) archive storage database, which has unspecified impact and attack vectors. An attacker could use this vulnerability to control the device. Remote attackers with knowledge of the default credentials may exploit these vulnerabilities to gain unauthorized access and perform unauthorized actions. This may aid in further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0526",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "centricity clinical archive audit trail repository",
"scope": "eq",
"trust": 1.0,
"vendor": "gehealthcare",
"version": "*"
},
{
"model": "centricity clinical archive audit trail repository",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "centricity clinical archive audit trail repository",
"scope": null,
"trust": 0.6,
"vendor": "ge",
"version": null
},
{
"model": "centricity clinical archive audit trail repository",
"scope": null,
"trust": 0.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "electric healthcare centricity clinical archive audit trail repository",
"scope": "eq",
"trust": 0.3,
"vendor": "general",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"db": "BID",
"id": "76164"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_clinical_archive_audit_trail_repository:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-9736"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven of Protiviti.",
"sources": [
{
"db": "BID",
"id": "76164"
}
],
"trust": 0.3
},
"cve": "CVE-2014-9736",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2014-9736",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05134",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-9736",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05134",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-037",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity Clinical Archive Audit Trail Repository has a default password of initinit for the (1) SSL key manager and (2) server keystore; (3) keystore_password for the server truststore; and atna for the (4) primary storage database and (5) archive storage database, which has unspecified impact and attack vectors. An attacker could use this vulnerability to control the device. \nRemote attackers with knowledge of the default credentials may exploit these vulnerabilities to gain unauthorized access and perform unauthorized actions. This may aid in further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"db": "BID",
"id": "76164"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-9736",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004012",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-05134",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-037",
"trust": 0.6
},
{
"db": "BID",
"id": "76164",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"db": "BID",
"id": "76164"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
]
},
"id": "VAR-201508-0526",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05134"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05134"
}
]
},
"last_update_date": "2023-12-18T12:44:59.426000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Audit Trail Repository Installation and Service Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/doc1474072_atr_instsvcman.pdf?req=raa\u0026direction=doc1474072\u0026filename=doc1474072_atr_instsvcman.pdf\u0026filerev=--\u0026docrev_org=--"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"db": "NVD",
"id": "CVE-2014-9736"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 1.9,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 1.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/doc1474072_atr_instsvcman.pdf?req=raa\u0026direction=doc1474072\u0026filename=doc1474072_atr_instsvcman.pdf\u0026filerev=--\u0026docrev_org=--"
},
{
"trust": 1.2,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/doc1474072_atr_instsvcman.pdf?req=raa\u0026amp;direction=doc1474072\u0026amp;filename=doc1474072_atr_instsvcman.pdf\u0026amp;filerev=--\u0026amp;docrev_org=--"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9736"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9736"
},
{
"trust": 0.3,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/doc1474072_atr_instsvcman.pdf?req=raa\u0026direction=doc1474072\u0026filename=doc1474072_atr_instsvcman.pdf\u0026filerev=--\u0026docrev_org=-- "
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en/global_gateway"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"db": "BID",
"id": "76164"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"db": "BID",
"id": "76164"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"date": "2015-07-10T00:00:00",
"db": "BID",
"id": "76164"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"date": "2015-08-04T14:59:26.720000",
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05134"
},
{
"date": "2015-07-10T00:00:00",
"db": "BID",
"id": "76164"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004012"
},
{
"date": "2015-08-04T19:25:23.240000",
"db": "NVD",
"id": "CVE-2014-9736"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity Clinical Archive Audit Trail Repository Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004012"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-037"
}
],
"trust": 0.6
}
}
VAR-201508-0010
Vulnerability from variot - Updated: 2023-12-18 12:30GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen. NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default. GE Healthcare Optima MR360 is a magnetic resonance imaging (MRI) system for the medical industry. An attacker can exploit this issue to gain unauthorized access to the affected device. Successful exploits will result in the complete compromise of the affected device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0010",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "optima mr360",
"scope": "eq",
"trust": 1.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "optima mr360",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "optima mr360",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "optima mr360",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"db": "BID",
"id": "76260"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:optima_mr360_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-5308"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven",
"sources": [
{
"db": "BID",
"id": "76260"
}
],
"trust": 0.3
},
"cve": "CVE-2010-5308",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-5308",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05172",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-47913",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-5308",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05172",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-022",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-47913",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"db": "VULHUB",
"id": "VHN-47913"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen. NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default. GE Healthcare Optima MR360 is a magnetic resonance imaging (MRI) system for the medical industry. \nAn attacker can exploit this issue to gain unauthorized access to the affected device. Successful exploits will result in the complete compromise of the affected device",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"db": "BID",
"id": "76260"
},
{
"db": "VULHUB",
"id": "VHN-47913"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-5308",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201508-022",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-05172",
"trust": 0.6
},
{
"db": "BID",
"id": "76260",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-47913",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"db": "VULHUB",
"id": "VHN-47913"
},
{
"db": "BID",
"id": "76260"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
]
},
"id": "VAR-201508-0010",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-47913"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:30:19.791000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Optima MR360 1.5T MR system Operator Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/mr360%20operator%20manual%20paper.pdf?docclass=a\u0026req=rac\u0026direction=5339461-1en\u0026filename=mr360+operator+manual+paper.pdf\u0026filerev=4\u0026docrev_org=4\u0026submit=+accept+"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-47913"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"db": "NVD",
"id": "CVE-2010-5308"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.0,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 1.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/mr360+operator+manual+paper.pdf?req=raa\u0026direction=5339461-1en\u0026filename=mr360%2boperator%2bmanual%2bpaper.pdf\u0026filerev=4\u0026docrev_org=4"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-5308"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-5308"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en/global_gateway"
},
{
"trust": 0.3,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/mr360%20operator%20manual%20paper.pdf?docclass=a\u0026req=rac\u0026direction=5339461-1en\u0026filename=mr360+operator+manual+paper.pdf\u0026filerev=4\u0026docrev_org=4\u0026submit"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/mr360+operator+manual+paper.pdf?req=raa\u0026amp;direction=5339461-1en\u0026amp;filename=mr360%2boperator%2bmanual%2bpaper.pdf\u0026amp;filerev=4\u0026amp;docrev_org=4"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"db": "VULHUB",
"id": "VHN-47913"
},
{
"db": "BID",
"id": "76260"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"db": "VULHUB",
"id": "VHN-47913"
},
{
"db": "BID",
"id": "76260"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-47913"
},
{
"date": "2015-07-10T00:00:00",
"db": "BID",
"id": "76260"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"date": "2015-08-04T14:59:11.503000",
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05172"
},
{
"date": "2015-08-05T00:00:00",
"db": "VULHUB",
"id": "VHN-47913"
},
{
"date": "2015-07-10T00:00:00",
"db": "BID",
"id": "76260"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004015"
},
{
"date": "2015-08-05T11:31:44.633000",
"db": "NVD",
"id": "CVE-2010-5308"
},
{
"date": "2015-08-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Optima MR360 Vulnerabilities to gain access to",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004015"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-022"
}
],
"trust": 0.6
}
}
VAR-201508-0008
Vulnerability from variot - Updated: 2023-12-18 12:07GE Healthcare Optima CT680, CT540, CT640, and CT520 has a default password of #bigguy for the root user, which has unspecified impact and attack vectors. GE Healthcare Optima CT680, CT540, CT640, and CT520 are general computed tomography products for the medical industry. Multiple GE Healthcare Products are prone to an insecure default-password vulnerability. Remote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. An attacker could exploit this vulnerability to take control of the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0008",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "optima ct540",
"scope": "eq",
"trust": 1.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "optima ct680",
"scope": "eq",
"trust": 1.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "optima ct520",
"scope": "eq",
"trust": 1.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "optima ct520",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "optima ct540",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "optima ct640",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "optima ct680",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "optima ct680",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "optima ct540",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "optima ct640",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "optima ct520",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "optima ct680",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
},
{
"model": "optima ct640",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
},
{
"model": "optima ct540",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
},
{
"model": "optima ct520",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"db": "BID",
"id": "76262"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:optima_ct520_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:optima_ct680_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:optima_ct540_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-5306"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven of Protiviti.",
"sources": [
{
"db": "BID",
"id": "76262"
}
],
"trust": 0.3
},
"cve": "CVE-2010-5306",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-5306",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05169",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-47911",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-5306",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05169",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-020",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-47911",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"db": "VULHUB",
"id": "VHN-47911"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Optima CT680, CT540, CT640, and CT520 has a default password of #bigguy for the root user, which has unspecified impact and attack vectors. GE Healthcare Optima CT680, CT540, CT640, and CT520 are general computed tomography products for the medical industry. Multiple GE Healthcare Products are prone to an insecure default-password vulnerability. \nRemote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. An attacker could exploit this vulnerability to take control of the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"db": "BID",
"id": "76262"
},
{
"db": "VULHUB",
"id": "VHN-47911"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-5306",
"trust": 3.4
},
{
"db": "ICS CERT",
"id": "ICSMA-18-037-02",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201508-020",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-05169",
"trust": 0.6
},
{
"db": "BID",
"id": "76262",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-47911",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"db": "VULHUB",
"id": "VHN-47911"
},
{
"db": "BID",
"id": "76262"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
]
},
"id": "VAR-201508-0008",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"db": "VULHUB",
"id": "VHN-47911"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05169"
}
]
},
"last_update_date": "2023-12-18T12:07:03.208000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Optima CT680 Series Installation Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5472001-1en_rev2.pdf?docclass=a\u0026req=rac\u0026direction=5472001-1en\u0026filename=5472001-1en_rev2.pdf\u0026filerev=2\u0026docrev_org=2\u0026submit=+accept+"
},
{
"title": "BrightSpeed Elite/Optima CT540 Installation Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5341628-1en_r12.pdf?docclass=a\u0026req=rac\u0026direction=5341628-1en\u0026filename=5341628-1en_r12.pdf\u0026filerev=12\u0026docrev_org=12\u0026submit=+accept+"
},
{
"title": "Optima CT520 Series Installation Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5401943_rev%203.pdf?docclass=a\u0026req=rac\u0026direction=5401943\u0026filename=5401943_rev+3.pdf\u0026filerev=3\u0026docrev_org=3\u0026submit=+accept+"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-47911"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"db": "NVD",
"id": "CVE-2010-5306"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 1.9,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
},
{
"trust": 1.9,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5341628-1en_r12.pdf?req=raa\u0026direction=5341628-1en\u0026filename=5341628-1en_r12.pdf\u0026filerev=12\u0026docrev_org=12"
},
{
"trust": 1.9,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5401943_rev+3.pdf?req=raa\u0026direction=5401943\u0026filename=5401943_rev%2b3.pdf\u0026filerev=3\u0026docrev_org=3"
},
{
"trust": 1.9,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5472001-1en_rev2.pdf?req=raa\u0026direction=5472001-1en\u0026filename=5472001-1en_rev2.pdf\u0026filerev=2\u0026docrev_org=2"
},
{
"trust": 1.7,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-5306"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-5306"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en/global_gateway"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5341628-1en_r12.pdf?req=raa\u0026amp;direction=5341628-1en\u0026amp;filename=5341628-1en_r12.pdf\u0026amp;filerev=12\u0026amp;docrev_org=12"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5401943_rev+3.pdf?req=raa\u0026amp;direction=5401943\u0026amp;filename=5401943_rev%2b3.pdf\u0026amp;filerev=3\u0026amp;docrev_org=3"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5472001-1en_rev2.pdf?req=raa\u0026amp;direction=5472001-1en\u0026amp;filename=5472001-1en_rev2.pdf\u0026amp;filerev=2\u0026amp;docrev_org=2"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"db": "VULHUB",
"id": "VHN-47911"
},
{
"db": "BID",
"id": "76262"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"db": "VULHUB",
"id": "VHN-47911"
},
{
"db": "BID",
"id": "76262"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-47911"
},
{
"date": "2015-07-10T00:00:00",
"db": "BID",
"id": "76262"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"date": "2015-08-04T14:59:09.503000",
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05169"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULHUB",
"id": "VHN-47911"
},
{
"date": "2015-07-10T00:00:00",
"db": "BID",
"id": "76262"
},
{
"date": "2018-04-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004013"
},
{
"date": "2018-03-28T01:29:01.340000",
"db": "NVD",
"id": "CVE-2010-5306"
},
{
"date": "2015-08-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural GE Healthcare Optima Product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004013"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-020"
}
],
"trust": 0.6
}
}
VAR-201508-0020
Vulnerability from variot - Updated: 2023-12-18 12:07GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. The vulnerability stems from the ddpadmin user using 'ddpadmin' as the password. An attacker could use this vulnerability to control the device. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0020",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.0.1"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.0"
},
{
"model": "centricity pacs",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.0"
},
{
"model": "centricity pacs",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.0.1"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.0"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.0.1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"db": "BID",
"id": "76172"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-6695"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven",
"sources": [
{
"db": "BID",
"id": "76172"
}
],
"trust": 0.3
},
"cve": "CVE-2012-6695",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2012-6695",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05140",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-6695",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05140",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-031",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. The vulnerability stems from the ddpadmin user using \u0027ddpadmin\u0027 as the password. An attacker could use this vulnerability to control the device. \nAttackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"db": "BID",
"id": "76172"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-6695",
"trust": 3.3
},
{
"db": "ICS CERT",
"id": "ICSMA-18-037-02",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004006",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-05140",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-031",
"trust": 0.6
},
{
"db": "BID",
"id": "76172",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"db": "BID",
"id": "76172"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
]
},
"id": "VAR-201508-0020",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05140"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05140"
}
]
},
"last_update_date": "2023-12-18T12:07:03.177000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0 Release)",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0.1 Release)",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"db": "NVD",
"id": "CVE-2012-6695"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.2,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 1.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
},
{
"trust": 1.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"trust": 1.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-6695"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-6695"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"db": "BID",
"id": "76172"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"db": "BID",
"id": "76172"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76172"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"date": "2015-08-04T14:59:20.597000",
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05140"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76172"
},
{
"date": "2018-04-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004006"
},
{
"date": "2018-03-28T01:29:02.260000",
"db": "NVD",
"id": "CVE-2012-6695"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity PACS Vulnerability in workstation",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004006"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-031"
}
],
"trust": 0.6
}
}
VAR-201508-0002
Vulnerability from variot - Updated: 2023-12-18 12:07GE Healthcare Discovery 530C has a password of #bigguy1 for the (1) acqservice user and (2) wsservice user of the Xeleris System, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. GE Healthcare Discovery 530C is a suite of applications for the medical industry that provide automated analysis and reporting for magnetic resonance imaging.
GE Healthcare Discovery 530C has built-in accounts. The acqservice user and the Xeleris System wsservice user ‘# bigguy1’ are used as passwords, allowing remote attackers to use these accounts to control devices. Remote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. An attacker could exploit this vulnerability to take control of the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0002",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "discovery 530c",
"scope": "eq",
"trust": 1.6,
"vendor": "gehealthcare",
"version": null
},
{
"model": "discovery nm 530c",
"scope": null,
"trust": 0.8,
"vendor": "ge healthcare",
"version": null
},
{
"model": "discovery 530c",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
},
{
"model": "discovery 530c",
"scope": "eq",
"trust": 0.3,
"vendor": "gehealthcare",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"db": "BID",
"id": "76261"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:discovery_530c_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-5143"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven",
"sources": [
{
"db": "BID",
"id": "76261"
}
],
"trust": 0.3
},
"cve": "CVE-2009-5143",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-5143",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05167",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-42589",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-5143",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05167",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-019",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-42589",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2009-5143",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"db": "VULHUB",
"id": "VHN-42589"
},
{
"db": "VULMON",
"id": "CVE-2009-5143"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Discovery 530C has a password of #bigguy1 for the (1) acqservice user and (2) wsservice user of the Xeleris System, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. GE Healthcare Discovery 530C is a suite of applications for the medical industry that provide automated analysis and reporting for magnetic resonance imaging. \n\nGE Healthcare Discovery 530C has built-in accounts. The acqservice user and the Xeleris System wsservice user \u2018# bigguy1\u2019 are used as passwords, allowing remote attackers to use these accounts to control devices. \nRemote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. An attacker could exploit this vulnerability to take control of the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"db": "BID",
"id": "76261"
},
{
"db": "VULHUB",
"id": "VHN-42589"
},
{
"db": "VULMON",
"id": "CVE-2009-5143"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-5143",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-037-02",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201508-019",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-05167",
"trust": 0.6
},
{
"db": "BID",
"id": "76261",
"trust": 0.5
},
{
"db": "VULHUB",
"id": "VHN-42589",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2009-5143",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"db": "VULHUB",
"id": "VHN-42589"
},
{
"db": "VULMON",
"id": "CVE-2009-5143"
},
{
"db": "BID",
"id": "76261"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
]
},
"id": "VAR-201508-0002",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-42589"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:07:03.063000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Discovery NM 530c Nuclear Medicine Imaging System Installation Manual",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5323167-1en_r2.pdf?req=raa\u0026direction=5323167-1en\u0026filename=5323167-1en_r2.pdf\u0026filerev=2\u0026docrev_org=2"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42589"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"db": "NVD",
"id": "CVE-2009-5143"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.5,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
},
{
"trust": 1.8,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 1.7,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5323167-1en_r2.pdf?req=raa\u0026direction=5323167-1en\u0026filename=5323167-1en_r2.pdf\u0026filerev=2\u0026docrev_org=2"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-5143"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-5143"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/5323167-1en_r2.pdf?req=raa\u0026amp;direction=5323167-1en\u0026amp;filename=5323167-1en_r2.pdf\u0026amp;filerev=2\u0026amp;docrev_org=2"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/255.html"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/76261"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"db": "VULHUB",
"id": "VHN-42589"
},
{
"db": "VULMON",
"id": "CVE-2009-5143"
},
{
"db": "BID",
"id": "76261"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"db": "VULHUB",
"id": "VHN-42589"
},
{
"db": "VULMON",
"id": "CVE-2009-5143"
},
{
"db": "BID",
"id": "76261"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-10T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-42589"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2009-5143"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76261"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"date": "2015-08-04T14:59:08.347000",
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-10T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05167"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULHUB",
"id": "VHN-42589"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULMON",
"id": "CVE-2009-5143"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76261"
},
{
"date": "2018-04-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003998"
},
{
"date": "2018-03-28T01:29:01.120000",
"db": "NVD",
"id": "CVE-2009-5143"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Discovery 530C Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-003998"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-019"
}
],
"trust": 0.6
}
}
VAR-201508-0019
Vulnerability from variot - Updated: 2023-12-18 12:07GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice account, which has unspecified impact and attack vectors related to TimbuktuPro. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires it. GE Healthcare Centricity PACS is an image archiving and transmission system (PACS) for the medical industry of General Electric (GE). Workstation is a PACS workstation; Server is a PACS server. The vulnerability stems from the use of ‘2charGE’ as the password for the geservice account. An attacker could use this vulnerability to control the device. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0019",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.0.1"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.0"
},
{
"model": "centricity pacs server",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.0"
},
{
"model": "centricity pacs",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.0"
},
{
"model": "centricity pacs",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.0.1"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.0"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.0.1"
},
{
"model": "centricity pacs server",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.0"
},
{
"model": "healthcare centricity pacs workstation/server",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"db": "BID",
"id": "76175"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_server:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-6694"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "76175"
}
],
"trust": 0.3
},
"cve": "CVE-2012-6694",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2012-6694",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05141",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-6694",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05141",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-030",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice account, which has unspecified impact and attack vectors related to TimbuktuPro. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires it. GE Healthcare Centricity PACS is an image archiving and transmission system (PACS) for the medical industry of General Electric (GE). Workstation is a PACS workstation; Server is a PACS server. The vulnerability stems from the use of \u20182charGE\u2019 as the password for the geservice account. An attacker could use this vulnerability to control the device. \nAttackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"db": "BID",
"id": "76175"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-6694",
"trust": 3.3
},
{
"db": "ICS CERT",
"id": "ICSMA-18-037-02",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004005",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-05141",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-030",
"trust": 0.6
},
{
"db": "BID",
"id": "76175",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"db": "BID",
"id": "76175"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
]
},
"id": "VAR-201508-0019",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
}
]
},
"last_update_date": "2023-12-18T12:07:03.031000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0 Release)",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0.1 Release)",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"db": "NVD",
"id": "CVE-2012-6694"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.2,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 1.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
},
{
"trust": 1.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"trust": 1.6,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-6694"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-6694"
},
{
"trust": 0.3,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?docclass=a\u0026req=rac\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1\u0026submit=+ac"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"db": "BID",
"id": "76175"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"db": "BID",
"id": "76175"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76175"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"date": "2015-08-04T14:59:19.613000",
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76175"
},
{
"date": "2018-04-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004005"
},
{
"date": "2018-03-28T01:29:02.183000",
"db": "NVD",
"id": "CVE-2012-6694"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity PACS Workstation and Server Trust Management Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05141"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-030"
}
],
"trust": 0.6
}
}
VAR-201508-0001
Vulnerability from variot - Updated: 2023-12-18 12:07GE Healthcare Centricity DMS 4.2, 4.1, and 4.0 has a password of Muse!Admin for the Museadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. An attacker could use this vulnerability to control the device. Remote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0001",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "centricity dms",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.2"
},
{
"model": "centricity dms",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.1"
},
{
"model": "centricity dms",
"scope": "eq",
"trust": 1.9,
"vendor": "gehealthcare",
"version": "4.0"
},
{
"model": "centricity cardiology data management system",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.0"
},
{
"model": "centricity cardiology data management system",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.1"
},
{
"model": "centricity cardiology data management system",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.2"
},
{
"model": "healthcare centricity dms",
"scope": null,
"trust": 0.6,
"vendor": "general electric",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "BID",
"id": "76263"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:centricity_dms_firmware:4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:centricity_dms_firmware:4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:gehealthcare:centricity_dms_firmware:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-6757"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven of Protiviti.",
"sources": [
{
"db": "BID",
"id": "76263"
}
],
"trust": 0.3
},
"cve": "CVE-2007-6757",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2007-6757",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05142",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-30119",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-6757",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05142",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-018",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-30119",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2007-6757",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "VULHUB",
"id": "VHN-30119"
},
{
"db": "VULMON",
"id": "CVE-2007-6757"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity DMS 4.2, 4.1, and 4.0 has a password of Muse!Admin for the Museadmin user, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value. An attacker could use this vulnerability to control the device. \nRemote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "BID",
"id": "76263"
},
{
"db": "VULHUB",
"id": "VHN-30119"
},
{
"db": "VULMON",
"id": "CVE-2007-6757"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-6757",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-037-02",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201508-018",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-05142",
"trust": 0.6
},
{
"db": "BID",
"id": "76263",
"trust": 0.5
},
{
"db": "VULHUB",
"id": "VHN-30119",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2007-6757",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "VULHUB",
"id": "VHN-30119"
},
{
"db": "VULMON",
"id": "CVE-2007-6757"
},
{
"db": "BID",
"id": "76263"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
]
},
"id": "VAR-201508-0001",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "VULHUB",
"id": "VHN-30119"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
}
]
},
"last_update_date": "2023-12-18T12:07:02.966000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Centricity Cardiology Data Management System System Management Manual Software Version 4.1",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2019295-133g.pdf?req=raa\u0026direction=2019295-133\u0026filename=2019295-133g.pdf\u0026filerev=g\u0026docrev_org=g"
},
{
"title": "Centricity Cardiology Data Management System System Management Manual Software Version 4.0",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2019295-133d.pdf?req=raa\u0026direction=2019295-133d\u0026filename=2019295-133d.pdf\u0026filerev=d\u0026docrev_org=d"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30119"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"db": "NVD",
"id": "CVE-2007-6757"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.4,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 2.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
},
{
"trust": 1.7,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2019295-133d.pdf?req=raa\u0026direction=2019295-133d\u0026filename=2019295-133d.pdf\u0026filerev=d\u0026docrev_org=d"
},
{
"trust": 1.7,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2019295-133g.pdf?req=raa\u0026direction=2019295-133\u0026filename=2019295-133g.pdf\u0026filerev=g\u0026docrev_org=g"
},
{
"trust": 1.7,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/dms+sys+mgmt+manual.pdf?req=raa\u0026direction=doc1258180\u0026filename=dms%2bsys%2bmgmt%2bmanual.pdf\u0026filerev=3\u0026docrev_org=3"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-6757"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-6757"
},
{
"trust": 0.3,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2019295-133d.pdf?docclass=a\u0026req=rac\u0026direction=2019295-133d\u0026filename=2019295-133d.pdf\u0026filerev=d\u0026docrev_org=d\u0026submit=+accept+"
},
{
"trust": 0.3,
"url": "http://www3.gehealthcare.com/en/global_gateway"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2019295-133d.pdf?req=raa\u0026amp;direction=2019295-133d\u0026amp;filename=2019295-133d.pdf\u0026amp;filerev=d\u0026amp;docrev_org=d"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/2019295-133g.pdf?req=raa\u0026amp;direction=2019295-133\u0026amp;filename=2019295-133g.pdf\u0026amp;filerev=g\u0026amp;docrev_org=g"
},
{
"trust": 0.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/dms+sys+mgmt+manual.pdf?req=raa\u0026amp;direction=doc1258180\u0026amp;filename=dms%2bsys%2bmgmt%2bmanual.pdf\u0026amp;filerev=3\u0026amp;docrev_org=3"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/255.html"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/76263"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "VULHUB",
"id": "VHN-30119"
},
{
"db": "VULMON",
"id": "CVE-2007-6757"
},
{
"db": "BID",
"id": "76263"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "VULHUB",
"id": "VHN-30119"
},
{
"db": "VULMON",
"id": "CVE-2007-6757"
},
{
"db": "BID",
"id": "76263"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-30119"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2007-6757"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76263"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"date": "2015-08-04T14:59:07.300000",
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULHUB",
"id": "VHN-30119"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULMON",
"id": "CVE-2007-6757"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76263"
},
{
"date": "2018-04-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-003997"
},
{
"date": "2018-03-28T01:29:01.057000",
"db": "NVD",
"id": "CVE-2007-6757"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity DMS Trust Management Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05142"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-018"
}
],
"trust": 0.6
}
}
VAR-201508-0275
Vulnerability from variot - Updated: 2023-12-18 12:07GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of (1) CANal1 for the Administrator user and (2) iis for the IIS user, which has unspecified impact and attack vectors related to TimbuktuPro. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires it. (1) For admin users CANal1 password (2) IIS For users iis password It is unknown whether this password is default, hard-coded, or dependent on other systems or products that require a fixed value.It may be subject to unspecified effects and attacks. An attacker could use this vulnerability to control the device. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0275",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 2.2,
"vendor": "gehealthcare",
"version": "4.0.1"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 2.2,
"vendor": "gehealthcare",
"version": "4.0"
},
{
"model": "centricity pacs",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.0"
},
{
"model": "centricity pacs",
"scope": "eq",
"trust": 0.8,
"vendor": "ge healthcare",
"version": "4.0.1"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.0"
},
{
"model": "centricity pacs workstation",
"scope": "eq",
"trust": 0.6,
"vendor": "ge",
"version": "4.0.1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gehealthcare:centricity_pacs_workstation:4.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7442"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Scott Erven",
"sources": [
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
],
"trust": 1.2
},
"cve": "CVE-2013-7442",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2013-7442",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05137",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-7442",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05137",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-034",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2013-7442",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"db": "VULMON",
"id": "CVE-2013-7442"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of (1) CANal1 for the Administrator user and (2) iis for the IIS user, which has unspecified impact and attack vectors related to TimbuktuPro. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires it. (1) For admin users CANal1 password (2) IIS For users iis password It is unknown whether this password is default, hard-coded, or dependent on other systems or products that require a fixed value.It may be subject to unspecified effects and attacks. An attacker could use this vulnerability to control the device. \nAttackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
},
{
"db": "VULMON",
"id": "CVE-2013-7442"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-7442",
"trust": 3.7
},
{
"db": "ICS CERT",
"id": "ICSMA-18-037-02",
"trust": 1.9
},
{
"db": "BID",
"id": "76169",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004009",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2015-05137",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034",
"trust": 0.6
},
{
"db": "BID",
"id": "76178",
"trust": 0.3
},
{
"db": "VULMON",
"id": "CVE-2013-7442",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"db": "VULMON",
"id": "CVE-2013-7442"
},
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
]
},
"id": "VAR-201508-0275",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
}
]
},
"last_update_date": "2023-12-18T12:07:02.927000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0 Release)",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"title": "Centricity PACS Workstation Installation and Service Manual (PACS 4.0.1 Release)",
"trust": 0.8,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"db": "NVD",
"id": "CVE-2013-7442"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.7,
"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"
},
{
"trust": 2.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-037-02"
},
{
"trust": 1.4,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c401_ws_inst_sv_2069560001r1.pdf?req=raa\u0026direction=2069560-001\u0026filename=c401_ws_inst_sv_2069560001r1.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"trust": 1.2,
"url": "http://www3.gehealthcare.com/en"
},
{
"trust": 1.1,
"url": "https://twitter.com/digitalbond/status/619250429751222277"
},
{
"trust": 1.1,
"url": "http://apps.gehealthcare.com/servlet/clientservlet/c40_ws_inst_sv_2063534-001r2.pdf?req=raa\u0026direction=2063534-001\u0026filename=c40_ws_inst_sv_2063534-001r2.pdf\u0026filerev=1\u0026docrev_org=1"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7442"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7442"
},
{
"trust": 0.7,
"url": "https://www.securityfocus.com/bid/76169"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/255.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"db": "VULMON",
"id": "CVE-2013-7442"
},
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"db": "VULMON",
"id": "CVE-2013-7442"
},
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"date": "2015-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2013-7442"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76178"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76169"
},
{
"date": "2015-08-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"date": "2015-08-04T14:59:23.657000",
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"date": "2015-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-11-01T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"date": "2018-03-28T00:00:00",
"db": "VULMON",
"id": "CVE-2013-7442"
},
{
"date": "2015-08-04T00:00:00",
"db": "BID",
"id": "76178"
},
{
"date": "2019-04-12T17:00:00",
"db": "BID",
"id": "76169"
},
{
"date": "2018-04-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004009"
},
{
"date": "2018-03-28T01:29:02.450000",
"db": "NVD",
"id": "CVE-2013-7442"
},
{
"date": "2019-04-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE Healthcare Centricity PACS Workstation Trust Management Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05137"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-034"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "76178"
},
{
"db": "BID",
"id": "76169"
}
],
"trust": 0.6
}
}