Skip to content
OpenAdvisories
Critical ICSMA-18-037-02 23 CVEs

GE Medical Devices Vulnerability

Published Feb 6, 2018 · Updated Mar 13, 2018 · Revision 2

Vendor: GE Healthcare Product: CADstream Product: Centricity DMS Product: Centricity PACS RA1000 Product: Centricity PACS Server Product: Centricity PACS-IW Product: Discovery NM530c Product: Discovery NM750b Product: Discovery VH Product: Discovery XR656 Product: Discovery XR656 Plus Product: eNTEGRA 2.0/2.5 Processing and Review Workstation Product: GEMNet License server (EchoServer) Product: Image Vault 3.x medical imaging software Product: Infinia Product: Infinia with Hawkeye 4 / 1 Product: Millenium MG Product: Millenium MyoSIGHT Product: Millenium NC Product: Millenium VG Product: Optima 520 Product: Optima 540 Product: Optima 640 Product: Optima 680 Product: Optima MR360 Product: Precision MP/i Product: Revolution XQ/i Product: THUNIS-800+ Product: Xeleris 1.0 Product: Xeleris 1.1 +3 more

Summary

Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.

Vulnerabilities 23

  • Unscored —
    CVE-2001-1594

    GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Pole…

  • Unscored —
    CVE-2002-2446

    GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be c…

  • Unscored —
    CVE-2003-1603

    GE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the Interfile server or (2…

  • Unscored —
    CVE-2004-2777

    GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for t…

  • Unscored —
    CVE-2007-6757

    GE Healthcare Centricity DMS 4.2, 4.1, and 4.0 has a password of Muse!Admin for the Museadmin user, which has unspecifi…

  • Unscored —
    CVE-2009-5143

    GE Healthcare Discovery 530C has a password of #bigguy1 for the (1) acqservice user and (2) wsservice user of the Xeler…

  • Unscored —
    CVE-2010-5306

    GE Healthcare Optima CT680, CT540, CT640, and CT520 has a default password of #bigguy for the root user, which has unsp…

  • Unscored —
    CVE-2010-5307

    The HIPAA configuration interface in GE Healthcare Optima MR360 has a password of (1) operator for the root account, (2…

  • Unscored —
    CVE-2010-5309

    GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and …

  • Unscored —
    CVE-2010-5310

    The Acquisition Workstation for the GE Healthcare Revolution XQ/i has a password of adw3.1 for the sdc user, which has …

  • Unscored —
    CVE-2011-5322

    GE Healthcare Centricity Analytics Server 1.1 has a default password of (1) V0yag3r for the SQL Server sa user, (2) G3c…

  • Unscored —
    CVE-2012-6660

    GE Healthcare Precision MPi has a password of (1) orion for the serviceapp user, (2) orion for the clinical operator us…

  • Unscored —
    CVE-2012-6693

    GE Healthcare Centricity PACS 4.0 Server has a default password of (1) nasro for the nasro (ReadOnly) user and (2) nasr…

  • Unscored —
    CVE-2012-6694

    GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice ac…

  • Unscored —
    CVE-2012-6695

    GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has uns…

  • Unscored —
    CVE-2013-7404

    GE Healthcare Discovery NM 750b has a password of 2getin for the insite account for (1) Telnet and (2) FTP, which has u…

  • Unscored —
    CVE-2013-7442

    GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of (1) CANal1 for the Administrator user and (2)…

  • Unscored —
    CVE-2014-7232

    GE Healthcare Discovery XR656 and XR656 G2 has a password of (1) 2getin for the insite user, (2) 4$xray for the xruser …

  • Unscored —
    CVE-2014-7233

    GE Healthcare Precision THUNIS-800+ has a default password of (1) 1973 for the factory default System Utilities menu, (…

  • Unscored —
    CVE-2017-14002

    GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default o…

    GE Healthcare GE Infinia
  • Unscored —
    CVE-2017-14004

    GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credent…

    GE Healthcare GE GEMNet License server aka. (EchoServer)
  • Unscored —
    CVE-2017-14006

    GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use …

    GE Healthcare GE Xeleris
  • Unscored —
    CVE-2017-14008

    GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or ha…

    GE Healthcare GE Centricity PACS RA1000

Revision history

  1. #2

    ICSMA-18-037-02 GE Medical Devices Vulnerability (Update A)

  2. #1

    ICSMA-18-037-02P GE Medical Devices Vulnerability

References