Back to CVE records
High 7.4HealthcarePublished May 14, 2024
CVE-2024-1486Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
Updated under an hour ago ()
Does this affect you?
It affects GE HealthCare Venue and 21 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.20%, higher than 9% of scored CVEs.
Do this next
Start free and add your stack
Free account, 1 product
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
- CVSS
- 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-732
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.20% (percentile 9)
- Assigned by
- GEHC
- NVD analysis
- Deferred
- Record last updated
- Aug 16, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
GE HealthCare Venue ge_healthcare:venue (from the name) | R1; R2; from R3 through R3.3; from R4 through R4.2 | CNA record |
GE HealthCare Venue Go ge_healthcare:venue_go (from the name) | R2; from R3 through R3.3; from R4 through R4.2 | CNA record |
GE HealthCare Venue Fit ge_healthcare:venue_fit (from the name) | from R3 through R3.3; from R4 through R4.2 | CNA record |
GE HealthCare LOGIQ e ge_healthcare:logiq_e (from the name) | from R7 through R9.1.4; from R8 through R10.1.3; from R9 through R11.0.2 | CNA record |
GE HealthCare LOGIQ He ge_healthcare:logiq_he (from the name) | through R9.3.1 | CNA record |
GE HealthCare Vivid E ge_healthcare:vivid_e (from the name) | from E95 before 206; from E90 before 206; from E80 before 206; from E9 113.2 through 113.2 | CNA record |
GE HealthCare Vivid S ge_healthcare:vivid_s (from the name) | from 70N before 206; from 60N before 206 | CNA record |
GE HealthCare Vivid T ge_healthcare:vivid_t (from the name) | from T8 before 206; from T9 before 206 | CNA record |
GE HealthCare Vivid iq ge_healthcare:vivid_iq (from the name) | before 206 | CNA record |
GE HealthCare Invenia ABUS ge_healthcare:invenia_abus (from the name) | 1.2.3 | CNA record |
GE HealthCare Invenia ABUS 2.0 ge_healthcare:invenia_abus_2.0 (from the name) | before 2.2.9 | CNA record |
gehealthcare venue_firmware gehealthcare:venue_firmware | R1; R2; from R3 through R3.3; from R4 through R4.2 | CISA ADP |
gehealthcare venue_go_firmware gehealthcare:venue_go_firmware | R2; from R3 through R3.3; from R4 through R4.2 | CISA ADP |
gehealthcare venue_fit_firmware gehealthcare:venue_fit_firmware | from R3 through R3.3; from R4 through R4.2 | CISA ADP |
gehealthcare logiq_e_firmware gehealthcare:logiq_e_firmware | from R7 through R9.1.4; from R8 through R10.1.3; from R9 through R11.0.2 | CISA ADP |
gehealthcare logiq_he_firmware gehealthcare:logiq_he_firmware | through R9.3.1 | CISA ADP |
gehealthcare vivid_e_firmware gehealthcare:vivid_e_firmware | from E95 before 206; from E90 before 206; from E80 before 206; from E9 113.2 through 113.2 | CISA ADP |
gehealthcare vivid_s_firmware gehealthcare:vivid_s_firmware | from 70N before 206; from 60N before 206 | CISA ADP |
gehealthcare vivid_t_firmware gehealthcare:vivid_t_firmware | from T8 before 206; from T9 before 206 | CISA ADP |
gehealthcare vivid_iq_firmware gehealthcare:vivid_iq_firmware | before 206 | CISA ADP |
gehealthcare invenia_abus_firmware gehealthcare:invenia_abus_firmware | 1.2.3 | CISA ADP |
gehealthcare invenia_abus_2.0_firmware gehealthcare:invenia_abus_2.0_firmware | before 2.2.9 | CISA ADP |
References
- https://securityupdate.gehealthcare.com/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.