Vulnerability · Published May 14, 2024 · Assigned by GEHC
CVE-2024-1630Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
High 7.7
In plain English
A high-severity path traversal in LOGIQ e from GE HealthCare. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GE HealthCare | Venue | R1R2R3 – through R3.3R4 – through R4.3 |
| GE HealthCare | Venue Go | R2R3 – through R3.3R4 – through R4.3 |
| GE HealthCare | Venue Fit | R3 – through R3.3R4 – through R4.3 |
| GE HealthCare | LOGIQ e | R7 – through R9.1.4R8 – through R10.1.3R9 – through R11.0.3 |
| GE HealthCare | LOGIQ He | 0 – through R9.3.1 |
| GE HealthCare | Vivid E | E95 – before 206E90 – before 206E80 – before 206 |
| GE HealthCare | Vivid T | T8 – before 206T9 – before 206 |
| GE HealthCare | Vivid iq | 0 – before 206 |
| GE HealthCare | Voluson Expert 16 | 0BT24 |
| GE HealthCare | Voluson Expert 18 | 0BT24 |
| GE HealthCare | Voluson Expert 22 | 0BT24 |
| GE HealthCare | Voluson SWIFT | 0BT24 |
| GE HealthCare | LOGIQ E10 | 0 – before R3.2.0 |
| GE HealthCare | LOGIQ E10s | 0 – before R3.2.0 |
| GE HealthCare | LOGIQ Fortis | 0 – before R3.2.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N