Skip to content
OpenAdvisories
High · 7.4 CVE-2024-1486 EUVD-2024-17234GHSA-5x5p-62r5-2xx8

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Published May 14, 2024 · Updated Aug 16, 2024 · Assigned by GEHC

Vendor: GE Healthcare Product: Invenia ABUS Product: Invenia ABUS 2.0 Product: LOGIQ e Product: LOGIQ He Product: Venue Product: Venue Fit Product: Venue Go Product: Vivid E Product: Vivid iq Product: Vivid S Product: Vivid T

Description

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Affected products

VendorProductAffectedFixed
GE HealthCare Venue R1, R2, R3 – ≤ R3.3, R4 – ≤ R4.2 —
GE HealthCare Venue Go R2, R3 – ≤ R3.3, R4 – ≤ R4.2 —
GE HealthCare Venue Fit R3 – ≤ R3.3, R4 – ≤ R4.2 —
GE HealthCare LOGIQ e R7 – ≤ R9.1.4, R8 – ≤ R10.1.3, R9 – ≤ R11.0.2 —
GE HealthCare LOGIQ He ≤ R9.3.1 —
GE HealthCare Vivid E E95 – < 206, E90 – < 206, E80 – < 206, E9 113.2 – ≤ 113.2 206
GE HealthCare Vivid S 70N – < 206, 60N – < 206 206
GE HealthCare Vivid T T8 – < 206, T9 – < 206 206
GE HealthCare Vivid iq < 206 206
GE HealthCare Invenia ABUS 1.2.3 —
GE HealthCare Invenia ABUS 2.0 < 2.2.9 2.2.9

Advisories 1

References