CVE-2024-1628
High
Description
OS command injection vulnerabilities in GE HealthCare ultrasound devices
SeverityHigh
CVSS8.4
Exploit probability—
ProductVenue
PublishedMay 14, 2024
First seenMay 14, 2024
Weakness typeCWE-78OS command injection
How to fix
Update
- GE HealthCare Vivid E206 or later
- GE HealthCare Vivid S206 or later
- GE HealthCare Vivid T206 or later
- GE HealthCare Vivid iq206 or later
- GE HealthCare Voluson Expert 16Ext1 or later
- GE HealthCare Voluson Expert 18Ext1 or later
- GE HealthCare Voluson Expert 22Ext1 or later
- GE HealthCare LOGIQ E10R3.2.0 or later
- GE HealthCare LOGIQ E10sR3.2.0 or later
- GE HealthCare LOGIQ FortisR3.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GE HealthCare Venue | R1, R2, R3 ≤ v ≤ R3.3, R4 ≤ v ≤ R4.3 | — |
| GE HealthCare Venue Go | R2, R3 ≤ v ≤ R3.3, R4 ≤ v ≤ R4.3 | — |
| GE HealthCare Venue Fit | R3 ≤ v ≤ R3.3, R4 ≤ v ≤ R4.3 | — |
| GE HealthCare LOGIQ e | R7 ≤ v ≤ R9.1.4, R8 ≤ v ≤ R10.1.3, R9 ≤ v ≤ R11.0.3 | — |
| GE HealthCare LOGIQ He | v ≤ R9.3.1 | — |
| GE HealthCare Vivid E | E95 ≤ v < 206, E90 ≤ v < 206, E80 ≤ v < 206 | 206 |
| GE HealthCare Vivid S | 70N ≤ v < 206, 60N ≤ v < 206 | 206 |
| GE HealthCare Vivid T | T8 ≤ v < 206, T9 ≤ v < 206 | 206 |
| GE HealthCare Vivid iq | v < 206 | 206 |
| GE HealthCare Voluson Expert 16 | 0, BT24 ≤ v < Ext1 | Ext1 |
| GE HealthCare Voluson Expert 18 | 0, BT24 ≤ v < Ext1 | Ext1 |
| GE HealthCare Voluson Expert 22 | 0, BT24 ≤ v < Ext1 | Ext1 |
| GE HealthCare Voluson SWIFT | 0, BT24 | — |
| GE HealthCare Invenia ABUS 2.0 | v ≤ 2.2.7 | — |
| GE HealthCare LOGIQ E10 | v < R3.2.0 | R3.2.0 |
| GE HealthCare LOGIQ E10s | v < R3.2.0 | R3.2.0 |
| GE HealthCare LOGIQ Fortis | v < R3.2.0 | R3.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.