Read the docs
TI-2024-01513 Aliases CVE-2024-1630GHSA-gwj2-vqgr-4qxf

Path traversal in GE HealthCare Venue

Priority HIGH 69CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00283 20th percentileScored 2026-11-07
Fix Fixed Vivid E (GE HealthCare): 206Vivid T (GE HealthCare): 206+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GE HealthCareVenueR1; R2; R3 – R3.3; R4 – R4.3—No fix listedCNA
GE HealthCareVenue GoR2; R3 – R3.3; R4 – R4.3—No fix listedCNA
GE HealthCareVenue FitR3 – R3.3; R4 – R4.3—No fix listedCNA
GE HealthCareLOGIQ eR7 – R9.1.4; R8 – R10.1.3; R9 – R11.0.3—No fix listedCNA
GE HealthCareLOGIQ Heup to R9.3.1—No fix listedCNA
GE HealthCareVivid EE95 to before 206; E90 to before 206; E80 to before 206206Patch availableCNA
GE HealthCareVivid TT8 to before 206; T9 to before 206206Patch availableCNA
GE HealthCareVivid iqbefore 206206Patch availableCNA
GE HealthCareVoluson Expert 16all versions; BT24—No fix listedCNA
GE HealthCareVoluson Expert 18all versions; BT24—No fix listedCNA
GE HealthCareVoluson Expert 22all versions; BT24—No fix listedCNA
GE HealthCareVoluson SWIFTall versions; BT24—No fix listedCNA
GE HealthCareLOGIQ E10before R3.2.0R3.2.0Patch availableCNA
GE HealthCareLOGIQ E10sbefore R3.2.0R3.2.0Patch availableCNA
GE HealthCareLOGIQ Fortisbefore R3.2.0R3.2.0Patch availableCNA
  • Venue VendorGE HealthCare Affected R1; R2; R3 – R3.3; R4 – R4.3 Fixed in — No fix listed CNA
  • Venue Go VendorGE HealthCare Affected R2; R3 – R3.3; R4 – R4.3 Fixed in — No fix listed CNA
  • Venue Fit VendorGE HealthCare Affected R3 – R3.3; R4 – R4.3 Fixed in — No fix listed CNA
  • LOGIQ e VendorGE HealthCare Affected R7 – R9.1.4; R8 – R10.1.3; R9 – R11.0.3 Fixed in — No fix listed CNA
  • LOGIQ He VendorGE HealthCare Affected up to R9.3.1 Fixed in — No fix listed CNA
  • Vivid E VendorGE HealthCare Affected E95 to before 206; E90 to before 206; E80 to before 206 Fixed in 206 Patch available CNA
  • Vivid T VendorGE HealthCare Affected T8 to before 206; T9 to before 206 Fixed in 206 Patch available CNA
  • Vivid iq VendorGE HealthCare Affected before 206 Fixed in 206 Patch available CNA
  • Voluson Expert 16 VendorGE HealthCare Affected all versions; BT24 Fixed in — No fix listed CNA
  • Voluson Expert 18 VendorGE HealthCare Affected all versions; BT24 Fixed in — No fix listed CNA
  • Voluson Expert 22 VendorGE HealthCare Affected all versions; BT24 Fixed in — No fix listed CNA
  • Voluson SWIFT VendorGE HealthCare Affected all versions; BT24 Fixed in — No fix listed CNA
  • LOGIQ E10 VendorGE HealthCare Affected before R3.2.0 Fixed in R3.2.0 Patch available CNA
  • LOGIQ E10s VendorGE HealthCare Affected before R3.2.0 Fixed in R3.2.0 Patch available CNA
  • LOGIQ Fortis VendorGE HealthCare Affected before R3.2.0 Fixed in R3.2.0 Patch available CNA

CPE names CISA-ADP · 15

CPEVersionsRoleVendor
cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:a:gehealthcare:voluson_expert_16:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:a:gehealthcare:voluson_expert_18:*:*:*:*:*:*:*:*——GE HealthCare
  • cpe:2.3:o:gehealthcare:venue_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:o:gehealthcare:venue_go_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:o:gehealthcare:venue_fit_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:o:gehealthcare:logiq_e_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:o:gehealthcare:logiq_he_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:o:gehealthcare:vivid_e_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:o:gehealthcare:vivid_t_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:o:gehealthcare:vivid_iq_firmware:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:a:gehealthcare:voluson_expert_16:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:a:gehealthcare:voluson_expert_18:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gehealthcare:voluson_expert_22:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:a:gehealthcare:voluson_swift:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:a:gehealthcare:logiq_e10:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:a:gehealthcare:logiq_e10s:*:*:*:*:*:*:*:*——GE HealthCare
cpe:2.3:a:gehealthcare:logiq_fortis:*:*:*:*:*:*:*:*——GE HealthCare
  • cpe:2.3:a:gehealthcare:voluson_expert_22:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:a:gehealthcare:voluson_swift:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:a:gehealthcare:logiq_e10:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:a:gehealthcare:logiq_e10s:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare
  • cpe:2.3:a:gehealthcare:logiq_fortis:*:*:*:*:*:*:*:* Versions — — ·GE HealthCare

Remediation

  • Fix · CNA Vivid E (GE HealthCare) Fixed in 206
  • Fix · CNA Vivid T (GE HealthCare) Fixed in 206
  • Fix · CNA Vivid iq (GE HealthCare) Fixed in 206
  • Fix · CNA LOGIQ E10 (GE HealthCare) Fixed in R3.2.0
  • Fix · CNA LOGIQ E10s (GE HealthCare) Fixed in R3.2.0
  • Fix · CNA LOGIQ Fortis (GE HealthCare) Fixed in R3.2.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GE HealthCare Vivid E, Vivid T, Vivid iq 206

    4 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2024-01511 OS command injection vulnerabilities in GE HealthCare ultrasound devicesPriority MEDIUM 40
    • TI-2024-01388 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devicesPriority LOW 34
    • TI-2024-01512 Path traversal in GE HealthCare VenuePriority LOW 27
    Show all 4 records →
  • Release ·

    GE HealthCare LOGIQ E10, LOGIQ E10s, LOGIQ Fortis R3.2.0

    3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-01511 OS command injection vulnerabilities in GE HealthCare ultrasound devicesPriority MEDIUM 40
    • TI-2024-01512 Path traversal in GE HealthCare VenuePriority LOW 27
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1630
  2. 2026-10-03 Alias added: GHSA-gwj2-vqgr-4qxf

References

Other 1

  • TI-2020-05610 Improper input validation in GE CARESCAPE Telemetry Server,ApexPro Telemetry… CVSS 3.1CRITICAL 10.0
  • TI-2017-10185 Improper authentication in GE Infinia CVSS 3.0CRITICAL 9.8
  • TI-2020-05611 Hard-coded credentials in GE CARESCAPE Telemetry Server,ApexPro Telemetry… CVSS 3.1CRITICAL 10.0
  • TI-2020-05614 In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 &… CVSS 3.1CRITICAL 10.0
  • TI-2017-10191 Improper authentication in GE Centricity PACS RA1000 CVSS 3.0CRITICAL 9.8
  • TI-2010-05004 GE Healthcare Optima CT680, CT540, CT640, and CT520 has a default password of #bigguy for… CVSS 2.0HIGH 10.0
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences