Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Priority LOW 34CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00201 10th percentileScored 2026-11-07
Fix Fixed Vivid E (GE HealthCare): 206Vivid S (GE HealthCare): 206+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GE HealthCare | Venue | R1; R2; R3 – R3.3; R4 – R4.2 | — | No fix listed | CNA |
| GE HealthCare | Venue Go | R2; R3 – R3.3; R4 – R4.2 | — | No fix listed | CNA |
| GE HealthCare | Venue Fit | R3 – R3.3; R4 – R4.2 | — | No fix listed | CNA |
| GE HealthCare | LOGIQ e | R7 – R9.1.4; R8 – R10.1.3; R9 – R11.0.2 | — | No fix listed | CNA |
| GE HealthCare | LOGIQ He | up to R9.3.1 | — | No fix listed | CNA |
| GE HealthCare | Vivid E | E95 to before 206; E90 to before 206; E80 to before 206; E9 113.2 – 113.2 | 206 | Patch available | CNA |
| GE HealthCare | Vivid S | 70N to before 206; 60N to before 206 | 206 | Patch available | CNA |
| GE HealthCare | Vivid T | T8 to before 206; T9 to before 206 | 206 | Patch available | CNA |
| GE HealthCare | Vivid iq | before 206 | 206 | Patch available | CNA |
| GE HealthCare | Invenia ABUS | 1.2.3 | — | No fix listed | CNA |
| GE HealthCare | Invenia ABUS 2.0 | before 2.2.9 | 2.2.9 | Patch available | CNA |
- Venue VendorGE HealthCare Affected R1; R2; R3 – R3.3; R4 – R4.2 Fixed in — No fix listed CNA
- Venue Go VendorGE HealthCare Affected R2; R3 – R3.3; R4 – R4.2 Fixed in — No fix listed CNA
- Venue Fit VendorGE HealthCare Affected R3 – R3.3; R4 – R4.2 Fixed in — No fix listed CNA
- LOGIQ e VendorGE HealthCare Affected R7 – R9.1.4; R8 – R10.1.3; R9 – R11.0.2 Fixed in — No fix listed CNA
- LOGIQ He VendorGE HealthCare Affected up to R9.3.1 Fixed in — No fix listed CNA
- Vivid E VendorGE HealthCare Affected E95 to before 206; E90 to before 206; E80 to before 206; E9 113.2 – 113.2 Fixed in 206 Patch available CNA
- Vivid S VendorGE HealthCare Affected 70N to before 206; 60N to before 206 Fixed in 206 Patch available CNA
- Vivid T VendorGE HealthCare Affected T8 to before 206; T9 to before 206 Fixed in 206 Patch available CNA
- Vivid iq VendorGE HealthCare Affected before 206 Fixed in 206 Patch available CNA
- Invenia ABUS VendorGE HealthCare Affected 1.2.3 Fixed in — No fix listed CNA
- Invenia ABUS 2.0 VendorGE HealthCare Affected before 2.2.9 Fixed in 2.2.9 Patch available CNA
CPE names CISA-ADP · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:vivid_s_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
| cpe:2.3:o:gehealthcare:invenia_abus_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
- cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:vivid_s_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
- cpe:2.3:o:gehealthcare:invenia_abus_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
Show 1 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:gehealthcare:invenia_abus_2.0_firmware:*:*:*:*:*:*:*:* | — | — | GE HealthCare |
- cpe:2.3:o:gehealthcare:invenia_abus_2.0_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
Remediation
- Fix · CNA Vivid E (GE HealthCare) Fixed in 206
- Fix · CNA Vivid S (GE HealthCare) Fixed in 206
- Fix · CNA Vivid T (GE HealthCare) Fixed in 206
- Fix · CNA Vivid iq (GE HealthCare) Fixed in 206
- Fix · CNA Invenia ABUS 2.0 (GE HealthCare) Fixed in 2.2.9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
GE HealthCare Vivid E, Vivid T, Vivid iq 206
4 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2024-01513 Path traversal in GE HealthCare VenuePriority HIGH 69
- TI-2024-01511 OS command injection vulnerabilities in GE HealthCare ultrasound devicesPriority MEDIUM 40
- TI-2024-01512 Path traversal in GE HealthCare VenuePriority LOW 27
- Release ·
GE HealthCare Vivid S 206
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2024-01511 OS command injection vulnerabilities in GE HealthCare ultrasound devicesPriority MEDIUM 40
- TI-2024-01512 Path traversal in GE HealthCare VenuePriority LOW 27
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1486
- 2026-10-03 Alias added: GHSA-5x5p-62r5-2xx8
References
More GE HealthCare vulnerabilities
- TI-2024-01513 Path traversal in GE HealthCare Venue CVSS 3.1HIGH 7.7
- TI-2020-05610 Improper input validation in GE CARESCAPE Telemetry Server,ApexPro Telemetry… CVSS 3.1CRITICAL 10.0
- TI-2017-10185 Improper authentication in GE Infinia CVSS 3.0CRITICAL 9.8
- TI-2020-05611 Hard-coded credentials in GE CARESCAPE Telemetry Server,ApexPro Telemetry… CVSS 3.1CRITICAL 10.0
- TI-2020-05614 In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 &… CVSS 3.1CRITICAL 10.0
- TI-2017-10191 Improper authentication in GE Centricity PACS RA1000 CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-1486 · CVE Program
- CVE-2024-1486 · NVD
- FIRST EPSS
- GHSA-5x5p-62r5-2xx8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences