Vulnerability · Published Feb 20, 2020 · Assigned by icscert

CVE-2020-6977

Medium 6.8

In plain English

A medium-severity security flaw in GE Ultrasound Products from GE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS NVD)6.8Medium

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE Ultrasound Products: Vivid products - all versions; LOGIQ - all versions not including LOGIQ 100 Pro; Voluson - all versions; Versana Essential - all versions; Invenia ABUS Scan station - all versions; Venue - all versions not including Venue 40 R1-3 and Venue 50 R4-5

Affected products (as reported)

Vendor	Product	Versions
GE	GE Ultrasound Products	Vivid products - all versionsLOGIQ - all versions not including LOGIQ 100 ProVoluson - all versionsVersana Essential - all versionsInvenia ABUS Scan station - all versionsVenue - all versions not including Venue 40 R1-3 and Venue 50 R4-5

Weakness: CWE-693

References

https://www.us-cert.gov/ics/advisories/icsma-20-049-02 x_refsource_MISC