CVE-2024-1486

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

State: Published
Severity: 7.4 High
Published: May 14, 2024
Updated: Aug 16, 2024
Reserved: Feb 13, 2024

Description

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	GEHC

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
VenueGE HealthCare	R1Affected R2Affected R3 through R3.3Affected R4 through R4.2Affected
Venue GoGE HealthCare	R2Affected R3 through R3.3Affected R4 through R4.2Affected
Venue FitGE HealthCare	R3 through R3.3Affected R4 through R4.2Affected
LOGIQ eGE HealthCare	R7 through R9.1.4Affected R8 through R10.1.3Affected R9 through R11.0.2Affected
LOGIQ HeGE HealthCare	R9.3.1 and earlierAffected
Vivid EGE HealthCare	E95 to before 206Affected E90 to before 206Affected E80 to before 206Affected E9 113.2 through 113.2Affected
Vivid SGE HealthCare	70N to before 206Affected 60N to before 206Affected
Vivid TGE HealthCare	T8 to before 206Affected T9 to before 206Affected
Vivid iqGE HealthCare	before 206Affected
Invenia ABUSGE HealthCare	1.2.3Affected
Invenia ABUS 2.0GE HealthCare	before 2.2.9Affected

References

https://securityupdate.gehealthcare.com/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.