Back to CVE records
High 8.4HealthcarePublished May 14, 2024
CVE-2024-1628OS command injection vulnerabilities in GE HealthCare ultrasound devices
Updated under an hour ago ()
Does this affect you?
It affects GE HealthCare Venue and 19 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.84%, higher than 57% of scored CVEs.
Do this next
Start free and add your stack
Free account, 1 product
OS command injection vulnerabilities in GE HealthCare ultrasound devices
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.84% (percentile 57)
- Assigned by
- GEHC
- NVD analysis
- Deferred
- Record last updated
- Aug 1, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
GE HealthCare Venue ge_healthcare:venue (from the name) | R1; R2; from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare Venue Go ge_healthcare:venue_go (from the name) | R2; from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare Venue Fit ge_healthcare:venue_fit (from the name) | from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare LOGIQ e ge_healthcare:logiq_e (from the name) | from R7 through R9.1.4; from R8 through R10.1.3; from R9 through R11.0.3 | CNA record |
GE HealthCare LOGIQ He ge_healthcare:logiq_he (from the name) | through R9.3.1 | CNA record |
GE HealthCare Vivid E ge_healthcare:vivid_e (from the name) | from E95 before 206; from E90 before 206; from E80 before 206 | CNA record |
GE HealthCare Vivid S ge_healthcare:vivid_s (from the name) | from 70N before 206; from 60N before 206 | CNA record |
GE HealthCare Vivid T ge_healthcare:vivid_t (from the name) | from T8 before 206; from T9 before 206 | CNA record |
GE HealthCare Vivid iq ge_healthcare:vivid_iq (from the name) | before 206 | CNA record |
GE HealthCare Voluson Expert 16 ge_healthcare:voluson_expert_16 (from the name) | 0; from BT24 before Ext1 | CNA record |
GE HealthCare Voluson Expert 18 ge_healthcare:voluson_expert_18 (from the name) | 0; from BT24 before Ext1 | CNA record |
GE HealthCare Voluson Expert 22 ge_healthcare:voluson_expert_22 (from the name) | 0; from BT24 before Ext1 | CNA record |
GE HealthCare Voluson SWIFT ge_healthcare:voluson_swift (from the name) | 0; BT24 | CNA record |
GE HealthCare Invenia ABUS 2.0 ge_healthcare:invenia_abus_2.0 (from the name) | through 2.2.7 | CNA record |
GE HealthCare LOGIQ E10 ge_healthcare:logiq_e10 (from the name) | before R3.2.0 | CNA record |
GE HealthCare LOGIQ E10s ge_healthcare:logiq_e10s (from the name) | before R3.2.0 | CNA record |
GE HealthCare LOGIQ Fortis ge_healthcare:logiq_fortis (from the name) | before R3.2.0 | CNA record |
ge_healthcare venue ge_healthcare:venue | multiple versions | CISA ADP |
ge_healthcare vivid ge_healthcare:vivid | multiple versions | CISA ADP |
ge_healthcare voluson ge_healthcare:voluson | multiple versions | CISA ADP |
ge_healthcare logiq ge_healthcare:logiq | multiple versions | CISA ADP |
References
- https://securityupdate.gehealthcare.com/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.