Vulnerabilities > Gehealthcare

DATE CVE VULNERABILITY TITLE RISK
2020-12-14 CVE-2020-25179 Information Exposure vulnerability in Gehealthcare products
GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.
network
low complexity
gehealthcare CWE-200
7.5
2020-12-14 CVE-2020-25175 Insufficiently Protected Credentials vulnerability in Gehealthcare products
GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.
network
low complexity
gehealthcare CWE-522
5.0
2020-01-24 CVE-2020-6966 Inadequate Encryption Strength vulnerability in Gehealthcare products
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.
network
low complexity
gehealthcare CWE-326
critical
10.0
2020-01-24 CVE-2020-6965 Improper Input Validation vulnerability in Gehealthcare products
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.
network
low complexity
gehealthcare CWE-20
6.5
2020-01-24 CVE-2020-6964 Missing Authentication FOR Critical Function vulnerability in Gehealthcare products
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X and CARESCAPE Central Station (CSCS) Versions 2.X, the integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.
network
low complexity
gehealthcare CWE-306
5.0
2020-01-24 CVE-2020-6963 Improper Input Validation vulnerability in Gehealthcare products
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.
network
low complexity
gehealthcare CWE-20
critical
10.0
2020-01-24 CVE-2020-6962 Improper Input Validation vulnerability in Gehealthcare products
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X CARESCAPE Central Station (CSCS) Versions 2.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, an input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.
network
low complexity
gehealthcare CWE-20
critical
10.0
2020-01-24 CVE-2020-6961 Insufficiently Protected Credentials vulnerability in Gehealthcare products
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.
network
low complexity
gehealthcare CWE-522
7.5
2015-08-04 CVE-2014-9736 Credentials Management vulnerability in Gehealthcare Centricity Clinical Archive Audit Trail Repository
GE Healthcare Centricity Clinical Archive Audit Trail Repository has a default password of initinit for the (1) SSL key manager and (2) server keystore; (3) keystore_password for the server truststore; and atna for the (4) primary storage database and (5) archive storage database, which has unspecified impact and attack vectors.
network
low complexity
gehealthcare CWE-255
critical
10.0
2015-08-04 CVE-2014-7233 Credentials Management vulnerability in Gehealthcare Precision Thunis-800+
GE Healthcare Precision THUNIS-800+ has a default password of (1) 1973 for the factory default System Utilities menu, (2) TH8740 for installation using TH8740_122_Setup.exe, (3) hrml for "Setup and Activation" using DSASetup, and (4) an empty string for Shutter Configuration, which has unspecified impact and attack vectors.
network
low complexity
gehealthcare CWE-255
critical
10.0