Vulnerability · Published May 14, 2024 · Assigned by GEHC
CVE-2024-1486Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
High 7.4
In plain English
A high-severity incorrect permission assignment in Invenia ABUS from GE HealthCare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GE HealthCare | Venue | R1R2R3 – through R3.3R4 – through R4.2 |
| GE HealthCare | Venue Go | R2R3 – through R3.3R4 – through R4.2 |
| GE HealthCare | Venue Fit | R3 – through R3.3R4 – through R4.2 |
| GE HealthCare | LOGIQ e | R7 – through R9.1.4R8 – through R10.1.3R9 – through R11.0.2 |
| GE HealthCare | LOGIQ He | 0 – through R9.3.1 |
| GE HealthCare | Vivid E | E95 – before 206E90 – before 206E80 – before 206E9 113.2 – through 113.2 |
| GE HealthCare | Vivid S | 70N – before 20660N – before 206 |
| GE HealthCare | Vivid T | T8 – before 206T9 – before 206 |
| GE HealthCare | Vivid iq | 0 – before 206 |
| GE HealthCare | Invenia ABUS | 1.2.3 |
| GE HealthCare | Invenia ABUS 2.0 | 0 – before 2.2.9 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H