Versana Active
System, Imaging, Pulsed Doppler, Ultrasonic. Attributes come from GE HealthCare's own public documentation for this product.
Attributes
Signals
Properties (MITRE EMB3D)
PID-123 Device includes ROM, VRAM, or removable Storage PID-14 Device includes external peripheral interconnects (e.g., USB, Serial) PID-31 Application-level software is present and running on the device PID-33 Device includes interactive applications, services, or user interfaces PID-41 Device exposes remote network services PID-411 Device exposes remote services with the ability to send, receive, view or modify sensitive information or configurations
Attributes: component types
API Battery Circuit Board Display Generic Application Local Application Local Service Sensor Modules Storage User Interface Wireless Module
Attributes: interface types
Bluetooth DisplayPort Ethernet USB WiFi
Attributes: assets
Patient Data
Attributes: dataflows
DVD/USB/LAN/WiFi to Ultrasound System (data import) External ECG Module to Ultrasound System (gating/triggering input) Ultrasound System to DVD/USB/LAN/WiFi (data export) Ultrasound System to Personal Device over Bluetooth (patient data/images)
Matched threat intel
10
Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what GE HealthCare has said.
| Advisory | Date | Shared | GE HealthCare status |
|---|---|---|---|
| Flow Neuroscience FL-100 ships a shared Bluetooth credential in every unit | Aug 13, 2026 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| Missing authentication lets an attacker rewrite a cardiac wearable | May 28, 2026 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| Unrestricted file upload on a PACS points straight at code execution | Apr 10, 2025 | Same property (MITRE EMB3D)PID-411 | No feedback feed from manufacturer |
| Philips Gemini PET/CT systems write sensitive data to removable media without access control | Mar 25, 2021 | Same property (MITRE EMB3D)PID-123 | No feedback feed from manufacturer |
| Capsule Technologies SmartLinx Neuron 2 kiosk escapes to admin with a USB keyboard | Jul 14, 2020 | Same property (MITRE EMB3D)PID-14 | No feedback feed from manufacturer |
| Boston Scientific ZOOM LATITUDE PRM uses a hard-coded key and leaves patient data unencrypted | Oct 19, 2017 | Same property (MITRE EMB3D)PID-123 | No feedback feed from manufacturer |
| Canon Medical flags FragAttacks Wi-Fi flaws in wireless FPD and ultrasound wireless options | Jul 4, 2022 | Same attributes (interface and component types)WiFi, Wireless Module | No feedback feed from manufacturer |
| Philips IntelliVue MX40 WLAN monitors can drop local alarming after 802.11 faults | Sep 12, 2017 | Same attributes (interface and component types)WiFi, Wireless Module | No feedback feed from manufacturer |
| Smiths Medical Medfusion 4000 syringe pump ships hard-coded wireless, FTP and Telnet credentials | Sep 7, 2017 | Same attributes (interface and component types)Ethernet, Wireless Module | No feedback feed from manufacturer |
| Philips Veradius Unity, Pulsera and Endura Dual WAN routers use weak encryption | Dec 19, 2019 | Same signals | No feedback feed from manufacturer |
Threats and weaknesses in matched advisories
MITRE EMB3D threats
TID-202 Exploitable System Network Stack Component TID-204 Untrusted Programs Can Access Privileged OS Functions TID-205 Existing OS Tools Maliciously Used for Device Manipulation TID-210 Device Vulnerabilities Unpatchable TID-219 OS/Kernel Privilege Escalation TID-221 Authentication Bypass By Message Replay TID-222 Critical System Service May Be Disabled TID-226 Device leaks security information in logs TID-305 Program Executes Dangerous System Calls TID-310 Remotely Accessible Unauthenticated Services TID-311 Default Credentials TID-316 Incorrect Certificate Verification Allows Authentication Bypass TID-317 Predictable Cryptographic Key TID-323 Path Traversal TID-324 HTTP Direct Object Reference TID-327 Out of Bounds Memory Access TID-328 Hardcoded Credentials TID-329 Improper Password Storage TID-404 Remotely Triggerable Deadlock/DoS TID-405 Network Stack Resource Exhaustion TID-406 Unauthorized Messages or Connections TID-407 Missing Message Replay Protection TID-408 Unencrypted Sensitive Data Communication TID-411 Weak/Insecure Cryptographic Protocol
CWE weaknesses
CWE-1104 Use of Unmaintained Third Party Components CWE-1392 Use of Default Credentials CWE-1395 Dependency on Vulnerable Third-Party Component CWE-20 Improper Input Validation CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-22 Improper Limitation of a Pathname to a Restricted Directory CWE-284 Improper Access Control CWE-290 Authentication Bypass by Spoofing CWE-294 Authentication Bypass by Capture-replay CWE-306 Missing Authentication for Critical Function CWE-319 Cleartext Transmission of Sensitive Information CWE-321 Use of Hard-coded Cryptographic Key CWE-326 Inadequate Encryption Strength CWE-400 Uncontrolled Resource Consumption CWE-427 Uncontrolled Search Path Element CWE-434 Unrestricted Upload of File with Dangerous Type CWE-476 NULL Pointer Dereference CWE-522 Insufficiently Protected Credentials CWE-639 Authorization Bypass Through User-Controlled Key CWE-798 Use of Hard-coded Credentials CWE-916 Use of Password Hash With Insufficient Computational Effort