CVE-2024-1486
High
Description
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
SeverityHigh
CVSS7.4
Exploit probability—
ProductVenue
PublishedMay 14, 2024
First seenMay 14, 2024
Weakness typeCWE-732CWE-732
How to fix
Update
- GE HealthCare Vivid E206 or later
- GE HealthCare Vivid S206 or later
- GE HealthCare Vivid T206 or later
- GE HealthCare Vivid iq206 or later
- GE HealthCare Invenia ABUS 2.02.2.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GE HealthCare Venue | R1, R2, R3 ≤ v ≤ R3.3, R4 ≤ v ≤ R4.2 | — |
| GE HealthCare Venue Go | R2, R3 ≤ v ≤ R3.3, R4 ≤ v ≤ R4.2 | — |
| GE HealthCare Venue Fit | R3 ≤ v ≤ R3.3, R4 ≤ v ≤ R4.2 | — |
| GE HealthCare LOGIQ e | R7 ≤ v ≤ R9.1.4, R8 ≤ v ≤ R10.1.3, R9 ≤ v ≤ R11.0.2 | — |
| GE HealthCare LOGIQ He | v ≤ R9.3.1 | — |
| GE HealthCare Vivid E | E95 ≤ v < 206, E90 ≤ v < 206, E80 ≤ v < 206, E9 113.2 ≤ v ≤ 113.2 | 206 |
| GE HealthCare Vivid S | 70N ≤ v < 206, 60N ≤ v < 206 | 206 |
| GE HealthCare Vivid T | T8 ≤ v < 206, T9 ≤ v < 206 | 206 |
| GE HealthCare Vivid iq | v < 206 | 206 |
| GE HealthCare Invenia ABUS | 1.2.3 | — |
| GE HealthCare Invenia ABUS 2.0 | v < 2.2.9 | 2.2.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.