Read the docs
TI-2024-01511 Aliases CVE-2024-1628GHSA-7q49-g67j-hfp2

OS command injection vulnerabilities in GE HealthCare ultrasound devices

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

OS command injection vulnerabilities in GE HealthCare ultrasound devices

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00836 57th percentileScored 2026-11-07
Fix Fixed Vivid E (GE HealthCare): 206Vivid S (GE HealthCare): 206+8 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GE HealthCareVenueR1; R2; R3 – R3.3; R4 – R4.3—No fix listedCNA
GE HealthCareVenue GoR2; R3 – R3.3; R4 – R4.3—No fix listedCNA
GE HealthCareVenue FitR3 – R3.3; R4 – R4.3—No fix listedCNA
GE HealthCareLOGIQ eR7 – R9.1.4; R8 – R10.1.3; R9 – R11.0.3—No fix listedCNA
GE HealthCareLOGIQ Heup to R9.3.1—No fix listedCNA
GE HealthCareVivid EE95 to before 206; E90 to before 206; E80 to before 206206Patch availableCNA
GE HealthCareVivid S70N to before 206; 60N to before 206206Patch availableCNA
GE HealthCareVivid TT8 to before 206; T9 to before 206206Patch availableCNA
GE HealthCareVivid iqbefore 206206Patch availableCNA
GE HealthCareVoluson Expert 16all versions; BT24 to before Ext1Ext1Patch availableCNA
GE HealthCareVoluson Expert 18all versions; BT24 to before Ext1Ext1Patch availableCNA
GE HealthCareVoluson Expert 22all versions; BT24 to before Ext1Ext1Patch availableCNA
GE HealthCareVoluson SWIFTall versions; BT24—No fix listedCNA
GE HealthCareInvenia ABUS 2.0up to 2.2.7—No fix listedCNA
GE HealthCareLOGIQ E10before R3.2.0R3.2.0Patch availableCNA
GE HealthCareLOGIQ E10sbefore R3.2.0R3.2.0Patch availableCNA
GE HealthCareLOGIQ Fortisbefore R3.2.0R3.2.0Patch availableCNA
  • Venue VendorGE HealthCare Affected R1; R2; R3 – R3.3; R4 – R4.3 Fixed in — No fix listed CNA
  • Venue Go VendorGE HealthCare Affected R2; R3 – R3.3; R4 – R4.3 Fixed in — No fix listed CNA
  • Venue Fit VendorGE HealthCare Affected R3 – R3.3; R4 – R4.3 Fixed in — No fix listed CNA
  • LOGIQ e VendorGE HealthCare Affected R7 – R9.1.4; R8 – R10.1.3; R9 – R11.0.3 Fixed in — No fix listed CNA
  • LOGIQ He VendorGE HealthCare Affected up to R9.3.1 Fixed in — No fix listed CNA
  • Vivid E VendorGE HealthCare Affected E95 to before 206; E90 to before 206; E80 to before 206 Fixed in 206 Patch available CNA
  • Vivid S VendorGE HealthCare Affected 70N to before 206; 60N to before 206 Fixed in 206 Patch available CNA
  • Vivid T VendorGE HealthCare Affected T8 to before 206; T9 to before 206 Fixed in 206 Patch available CNA
  • Vivid iq VendorGE HealthCare Affected before 206 Fixed in 206 Patch available CNA
  • Voluson Expert 16 VendorGE HealthCare Affected all versions; BT24 to before Ext1 Fixed in Ext1 Patch available CNA
  • Voluson Expert 18 VendorGE HealthCare Affected all versions; BT24 to before Ext1 Fixed in Ext1 Patch available CNA
  • Voluson Expert 22 VendorGE HealthCare Affected all versions; BT24 to before Ext1 Fixed in Ext1 Patch available CNA
  • Voluson SWIFT VendorGE HealthCare Affected all versions; BT24 Fixed in — No fix listed CNA
  • Invenia ABUS 2.0 VendorGE HealthCare Affected up to 2.2.7 Fixed in — No fix listed CNA
  • LOGIQ E10 VendorGE HealthCare Affected before R3.2.0 Fixed in R3.2.0 Patch available CNA
  • LOGIQ E10s VendorGE HealthCare Affected before R3.2.0 Fixed in R3.2.0 Patch available CNA
  • LOGIQ Fortis VendorGE HealthCare Affected before R3.2.0 Fixed in R3.2.0 Patch available CNA

CPE names CISA-ADP · 4

CPEVersionsRoleVendor
cpe:2.3:a:ge_healthcare:venue:*:*:*:*:*:*:*:*———
cpe:2.3:a:ge_healthcare:vivid:*:*:*:*:*:*:*:*———
cpe:2.3:a:ge_healthcare:voluson:*:*:*:*:*:*:*:*———
cpe:2.3:a:ge_healthcare:logiq:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:ge_healthcare:venue:*:*:*:*:*:*:*:* Versions — — ·—
  • cpe:2.3:a:ge_healthcare:vivid:*:*:*:*:*:*:*:* Versions — — ·—
  • cpe:2.3:a:ge_healthcare:voluson:*:*:*:*:*:*:*:* Versions — — ·—
  • cpe:2.3:a:ge_healthcare:logiq:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA Vivid E (GE HealthCare) Fixed in 206
  • Fix · CNA Vivid S (GE HealthCare) Fixed in 206
  • Fix · CNA Vivid T (GE HealthCare) Fixed in 206
  • Fix · CNA Vivid iq (GE HealthCare) Fixed in 206
  • Fix · CNA Voluson Expert 16 (GE HealthCare) Fixed in Ext1
  • Fix · CNA Voluson Expert 18 (GE HealthCare) Fixed in Ext1
  • Fix · CNA Voluson Expert 22 (GE HealthCare) Fixed in Ext1
  • Fix · CNA LOGIQ E10 (GE HealthCare) Fixed in R3.2.0
  • Fix · CNA LOGIQ E10s (GE HealthCare) Fixed in R3.2.0
  • Fix · CNA LOGIQ Fortis (GE HealthCare) Fixed in R3.2.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GE HealthCare Vivid E, Vivid T, Vivid iq 206

    4 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2024-01513 Path traversal in GE HealthCare VenuePriority HIGH 69
    • TI-2024-01388 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devicesPriority LOW 34
    • TI-2024-01512 Path traversal in GE HealthCare VenuePriority LOW 27
    Show all 4 records →
  • Release ·

    GE HealthCare Vivid S 206

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2024-01388 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devicesPriority LOW 34
    • TI-2024-01512 Path traversal in GE HealthCare VenuePriority LOW 27
    Show all 3 records →
Show 1 more group
  • Release ·

    GE HealthCare LOGIQ E10, LOGIQ E10s, LOGIQ Fortis R3.2.0

    3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-01513 Path traversal in GE HealthCare VenuePriority HIGH 69
    • TI-2024-01512 Path traversal in GE HealthCare VenuePriority LOW 27
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1628
  2. 2026-10-03 Alias added: GHSA-7q49-g67j-hfp2

References

Other 1

  • TI-2024-01513 Path traversal in GE HealthCare Venue CVSS 3.1HIGH 7.7
  • TI-2020-05610 Improper input validation in GE CARESCAPE Telemetry Server,ApexPro Telemetry… CVSS 3.1CRITICAL 10.0
  • TI-2017-10185 Improper authentication in GE Infinia CVSS 3.0CRITICAL 9.8
  • TI-2020-05611 Hard-coded credentials in GE CARESCAPE Telemetry Server,ApexPro Telemetry… CVSS 3.1CRITICAL 10.0
  • TI-2020-05614 In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 &… CVSS 3.1CRITICAL 10.0
  • TI-2017-10191 Improper authentication in GE Centricity PACS RA1000 CVSS 3.0CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences